diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 3f1040f0..3975ba03 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -10,24 +10,32 @@ on:
         description: 'Tag for the SDK version'
         required: true
         default: 'latest'
+      dry_run:
+        description: 'Dry run (test without actually publishing)'
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
 
     steps:
     - uses: actions/checkout@v2
       with:
         fetch-depth: 0
         token: ${{ secrets.AMPERSAND_OPS_PAT }}
-        ref: main
+        ref: ${{ github.ref }}
 
     - name: Set up Node.js
       uses: actions/setup-node@v3
       with:
         node-version: '20'
         cache: 'npm'
-        always-auth: true
+        registry-url: 'https://registry.npmjs.org'
 
     - name: Install yarn
       run: npm i -g yarn
@@ -43,12 +51,16 @@ jobs:
 
     - name: Publish to npm
       id: publish_to_npm
-      run: echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc && yarn publish --non-interactive --tag ${{ github.event.inputs.tag }}
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      run: |
+        if [ "${{ github.event.inputs.dry_run }}" = "true" ]; then
+          echo "Running dry-run publish..."
+          npm publish --dry-run --access public --tag ${{ github.event.inputs.tag }}
+        else
+          npm publish --access public --tag ${{ github.event.inputs.tag }}
+        fi
 
     - name: Push changes back to repository
-      if: steps.publish_to_npm.conclusion == 'success'
+      if: steps.publish_to_npm.conclusion == 'success' && github.event.inputs.dry_run != 'true'
       run: |
         git config --global user.email "devops@withampersand.com"
         git config --global user.name "Ampersand Ops"
diff --git a/package.json b/package.json
index ced9063f..6e8d8aa6 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@amp-labs/react",
-  "version": "2.9.11",
+  "version": "2.9.12",
   "description": "Ampersand React library.",
   "author": {
     "name": "Ampersand Labs",
diff --git a/src/services/version.ts b/src/services/version.ts
index 78ca0919..43fb0d1b 100644
--- a/src/services/version.ts
+++ b/src/services/version.ts
@@ -1 +1 @@
-export const LIB_VERSION = "2.9.11";
+export const LIB_VERSION = "2.9.12";