diff --git a/.github/workflows/new-release.yml b/.github/workflows/new-release.yml
deleted file mode 100644
index 8d822eb7a73bc..0000000000000
--- a/.github/workflows/new-release.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Start new release
-
-on:
-  workflow_dispatch:
-    inputs:
-      name:
-        type: choice
-        description: Release type
-        default: next
-        required: true
-        options:
-          - next
-          - patch
-          - cut
-      base-ref:
-        description: Base version
-        default: develop
-        required: false
-
-env:
-  HUSKY: 0
-
-permissions: {}
-
-jobs:
-  new-release:
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.inputs.base-ref }}
-          fetch-depth: 0
-          token: ${{ secrets.CI_PAT }}
-
-      - name: Setup NodeJS
-        uses: ./.github/actions/setup-node
-        with:
-          cache-modules: true
-          install: true
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
-
-      - name: Build packages
-        run: yarn build
-
-      - name: 'Start release: ${{ github.event.inputs.name }}'
-        uses: ./packages/release-action
-        with:
-          action: ${{ github.event.inputs.name }}
-          base-ref: ${{ github.event.inputs.base-ref }}
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.CI_PAT }}
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
deleted file mode 100644
index 902bd777f4f46..0000000000000
--- a/.github/workflows/publish-release.yml
+++ /dev/null
@@ -1,46 +0,0 @@
-name: Publish Final Release
-
-on:
-  push:
-    branches:
-      - master
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-env:
-  HUSKY: 0
-
-permissions: {}
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.CI_PAT }}
-
-      - name: Setup NodeJS
-        uses: ./.github/actions/setup-node
-        with:
-          cache-modules: true
-          install: true
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
-
-      - name: Build packages
-        run: yarn build
-
-      - name: Publish final release
-        uses: ./packages/release-action
-        with:
-          action: publish-final
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.CI_PAT }}
diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml
deleted file mode 100644
index 7b3e9103dbe98..0000000000000
--- a/.github/workflows/release-candidate.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: Release candidate cut
-on:
-  schedule:
-    - cron: '28 21 20 * *' # run at minute 28 to avoid the chance of delay due to high load on GH
-
-permissions: {}
-
-jobs:
-  new-release:
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.ref_name }}
-          fetch-depth: 0
-          token: ${{ secrets.CI_PAT }}
-
-      - name: Setup NodeJS
-        uses: ./.github/actions/setup-node
-        with:
-          cache-modules: true
-          install: true
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
-
-      - name: Build packages
-        run: yarn build
-
-      - name: 'Start release candidate'
-        uses: ./packages/release-action
-        with:
-          action: next
-          base-ref: ${{ github.ref_name }}
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.CI_PAT }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000000000..02ebc89660d14
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,79 @@
+name: Release
+
+# Single entry point for every path that publishes to npm. npm allows one trusted
+# publisher per package and validates the entry-point workflow filename, so `cut`,
+# `next` and `publish-final` all have to run from this file.
+on:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: '28 21 20 * *' # run at minute 28 to avoid the chance of delay due to high load on GH
+  workflow_dispatch:
+    inputs:
+      name:
+        type: choice
+        description: Release type
+        default: next
+        required: true
+        options:
+          - next
+          - patch
+          - cut
+      base-ref:
+        description: Base version
+        default: develop
+        required: false
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+env:
+  HUSKY: 0
+
+permissions: {}
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write # npm trusted publishing (OIDC)
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'schedule' && github.ref_name || github.event_name == 'workflow_dispatch' && inputs.base-ref || '' }}
+          fetch-depth: 0
+          token: ${{ secrets.CI_PAT }}
+
+      - name: Setup NodeJS
+        uses: ./.github/actions/setup-node
+        with:
+          cache-modules: true
+          install: true
+          # Transitional: npm attempts the OIDC exchange first and overrides this token on
+          # success, so it only takes effect when the exchange fails. That keeps releases
+          # alive while packages are registered as trusted publishers one by one. Remove
+          # once every package reports a non-null dist.attestations — see docs/npm-publishing.md.
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      # Node 22 bundles npm 10, trusted publishing needs >= 11.5.1
+      - name: Setup npm
+        run: |
+          npm install -g npm@^11.15.0
+          npm --version
+
+      - uses: rharkor/caching-for-turbo@2238fae6eb9a9936f92356f54cb3660200d105e7 # v2.5.1
+
+      - name: Build packages
+        run: yarn build
+
+      - name: Release
+        uses: ./packages/release-action
+        with:
+          action: ${{ github.event_name == 'push' && 'publish-final' || github.event_name == 'schedule' && 'next' || inputs.name }}
+          base-ref: ${{ github.event_name == 'schedule' && github.ref_name || github.event_name == 'workflow_dispatch' && inputs.base-ref || '' }}
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }} # transitional, see the Setup NodeJS step
+          GITHUB_TOKEN: ${{ secrets.CI_PAT }}
diff --git a/CLAUDE.md b/CLAUDE.md
index 1338ebb9f4a79..4f6a8d8d72282 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -33,6 +33,7 @@ Read the doc that matches the task instead of scanning `docs/` wholesale.
 
 - [docs/meteor-modern-stack.md](docs/meteor-modern-stack.md) — Meteor modern build stack, file-watching caveats
 - [docs/coverage.md](docs/coverage.md) — coverage instrumentation in build and CI
+- [docs/npm-publishing.md](docs/npm-publishing.md) — how the public packages reach npm: `release.yml`, changesets, OIDC trusted publishing, provenance
 
 ### Other
 
diff --git a/docs/npm-publishing.md b/docs/npm-publishing.md
new file mode 100644
index 0000000000000..3fafde8d5ff2d
--- /dev/null
+++ b/docs/npm-publishing.md
@@ -0,0 +1,144 @@
+# npm publishing
+
+The public `@rocket.chat/*` packages under `packages/` are published to npm by
+`.github/workflows/release.yml`, which delegates to the local `packages/release-action`.
+Everything else in the workspace is `private: true` and never published.
+
+## How a publish happens
+
+`release.yml` is the **only** workflow that publishes. It carries three triggers and maps each one
+to a `release-action` mode:
+
+| Trigger                       | `action`        | Publishes? | dist-tag        |
+| ----------------------------- | --------------- | ---------- | --------------- |
+| `push` to `master`            | `publish-final` | yes        | `latest`        |
+| `schedule` (monthly, 20th)    | `next`          | yes        | `rc`            |
+| `workflow_dispatch` → `cut`   | `cut`           | yes        | `latest` / `rc` |
+| `workflow_dispatch` → `next`  | `next`          | yes        | `rc`            |
+| `workflow_dispatch` → `patch` | `patch`         | no         | —               |
+
+`publishRelease.ts` and `bumpNextVersion.ts` both end with `yarn changeset publish --no-git-tag`.
+Changesets then spawns `npm publish <packageDir> --access public --tag <tag>` from the repo root, so
+**the npm CLI on `PATH` is what authenticates** — not yarn.
+
+## Trusted publishing (OIDC)
+
+Publishing authenticates via [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/)
+rather than a long-lived token. GitHub Actions mints a short-lived, job-scoped credential at publish
+time, and npm attaches a provenance attestation to every published tarball.
+
+Two hard requirements, both handled in `release.yml`:
+
+- `permissions: id-token: write` on the publishing job — without it the runner never exposes
+  `ACTIONS_ID_TOKEN_REQUEST_URL` and the OIDC exchange cannot happen.
+- **npm >= 11.5.1** (the `Setup npm` step installs it). `engines.node` is 22.x, which bundles npm 10.
+
+### How `NPM_TOKEN` interacts with the exchange
+
+`npm publish` runs the OIDC exchange *before* it reads credentials, and on success it overrides the
+`~/.npmrc` auth line with the freshly minted token. A present `NPM_TOKEN` therefore does **not**
+prevent trusted publishing — the exchange still wins whenever it succeeds.
+
+The token matters only when the exchange fails. npm's `oidc()` is written to never throw: every
+failure path (missing `id-token` permission, package not registered, exchange rejected) returns
+quietly, and `publish` then proceeds with the npmrc token — no provenance, no error, exit code 0.
+
+That makes the token a **migration aid and a hazard at the same time**:
+
+- While packages are being registered one at a time, it keeps releases from hard-failing on the
+  ones that are not registered yet.
+- Once everything is registered, it hides regressions — a broken registration keeps publishing
+  under token auth instead of failing.
+
+So `release.yml` keeps `NPM_TOKEN` only until every package publishes with provenance, then drops
+both references (the `setup-node` input and the `Release` step's `env`).
+
+### Migrating packages incrementally
+
+npm allows one trusted publisher per package, so packages move over one at a time:
+
+1. Register the package (see below). Watch for packages previously released from another repo —
+   `@rocket.chat/emitter`'s last provenance came from `RocketChat/fuselage`'s `cd.yml`, and that
+   registration has to be re-pointed here before this workflow can publish it.
+2. Let a release run. The job log is not evidence — a token fallback looks identical to success.
+3. Confirm with `npm view @rocket.chat/<name> --json dist.attestations`; non-null means the package
+   is publishing through OIDC.
+4. When all published packages are attested, remove `NPM_TOKEN` from `release.yml`.
+
+### Why there is only one release workflow
+
+npm allows **one trusted publisher per package**, and it validates the _entry-point_ workflow
+filename — the `workflow_ref` OIDC claim. `workflow_call` reusable workflows inherit the caller's
+`workflow_ref`, so splitting the publish step into a shared workflow does not help: every caller
+would need its own registration. Hence the single `release.yml` with three triggers.
+
+**Renaming or moving `release.yml` breaks publishing** until every package's trusted publisher is
+updated on npmjs.com.
+
+### Registering a newly published package
+
+npm cannot configure a trusted publisher for a package that does not exist yet, so a brand-new
+package needs one manual first publish before it can be registered.
+
+Register from a machine with npm >= 11.15.0 and account-level 2FA (granular tokens with the
+bypass-2FA option are rejected):
+
+```sh
+npm trust github @rocket.chat/<name> \
+  --file release.yml \
+  --repo RocketChat/Rocket.Chat \
+  --allow-publish
+
+npm trust list @rocket.chat/<name>
+```
+
+Or on `npmjs.com/package/@rocket.chat/<name>/access`:
+
+| Field             | Value                                  |
+| ----------------- | -------------------------------------- |
+| Provider          | GitHub Actions                         |
+| Organization      | `RocketChat`                           |
+| Repository        | `Rocket.Chat`                          |
+| Workflow filename | `release.yml` (filename only, no path) |
+| Environment       | _(blank)_                              |
+| Allowed actions   | `npm publish`                          |
+
+No GitHub Environment is configured: the monthly RC cron and the push-to-master final release both
+run unattended, and an environment with required reviewers would stall them.
+
+### Provenance requires a correct `repository` field
+
+npm generates provenance automatically for public packages published from a public repo via OIDC,
+and **rejects the publish (422) when `repository.url` does not match the repository the workflow ran
+in**. Every published package therefore needs:
+
+```json
+"repository": {
+  "type": "git",
+  "url": "git+https://github.com/RocketChat/Rocket.Chat.git",
+  "directory": "packages/<name>"
+}
+```
+
+The org/repo casing (`RocketChat/Rocket.Chat`) has to match too.
+
+Verify after a release:
+
+```sh
+npm view @rocket.chat/<name> --json dist.attestations
+```
+
+A non-null result is proof the publish went through OIDC — token-based publishes from this repo
+never carried provenance.
+
+## Troubleshooting
+
+- **`E404` / `ENEEDAUTH` on `/-/npm/v1/oidc/token/exchange/package/…`** — almost always a
+  trusted-publisher mismatch: wrong repository, or the workflow filename entered with a path
+  (`.github/workflows/release.yml`) instead of bare `release.yml`.
+- **`E401` / `ENEEDAUTH` with no token configured** — the exchange failed and there was nothing to
+  fall back to. Run with `--loglevel verbose`: `oidc()` logs its reason (`Skipped because incorrect
+  permissions`, `Failed token exchange request…`) instead of throwing.
+- **422 on publish** — provenance mismatch; check the package's `repository` field.
+- **Silent fallback to token auth** — if a valid token is present npm may authenticate with it
+  instead. Confirm via `dist.attestations` rather than the job log.
diff --git a/packages/api-client/package.json b/packages/api-client/package.json
index d6df7399184c7..3bd7a80e66fe0 100644
--- a/packages/api-client/package.json
+++ b/packages/api-client/package.json
@@ -1,6 +1,11 @@
 {
 	"name": "@rocket.chat/api-client",
 	"version": "0.2.56",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
+		"directory": "packages/api-client"
+	},
 	"main": "./dist/index.js",
 	"typings": "./dist/index.d.ts",
 	"files": [
diff --git a/packages/apps-engine/package.json b/packages/apps-engine/package.json
index 731321e8c799c..7cd344f724bb7 100644
--- a/packages/apps-engine/package.json
+++ b/packages/apps-engine/package.json
@@ -13,7 +13,8 @@
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/RocketChat/Rocket.Chat.git"
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
+		"directory": "packages/apps-engine"
 	},
 	"license": "MIT",
 	"author": {
@@ -76,9 +77,6 @@
 	"volta": {
 		"extends": "../../package.json"
 	},
-	"publishConfig": {
-		"access": "public"
-	},
 	"installConfig": {
 		"hoistingLimits": "workspaces"
 	}
diff --git a/packages/core-typings/package.json b/packages/core-typings/package.json
index d50ba6a4bdce5..e0a6dde63d5eb 100644
--- a/packages/core-typings/package.json
+++ b/packages/core-typings/package.json
@@ -2,6 +2,11 @@
 	"$schema": "https://json.schemastore.org/package",
 	"name": "@rocket.chat/core-typings",
 	"version": "8.9.0-develop",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
+		"directory": "packages/core-typings"
+	},
 	"main": "./dist/index.js",
 	"typings": "./dist/index.d.ts",
 	"files": [
diff --git a/packages/ddp-client/package.json b/packages/ddp-client/package.json
index 598f7f3946ea1..f28475382cd0b 100644
--- a/packages/ddp-client/package.json
+++ b/packages/ddp-client/package.json
@@ -1,6 +1,11 @@
 {
 	"name": "@rocket.chat/ddp-client",
 	"version": "1.1.1",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
+		"directory": "packages/ddp-client"
+	},
 	"main": "./dist/index.js",
 	"typings": "./dist/index.d.ts",
 	"files": [
diff --git a/packages/desktop-api/package.json b/packages/desktop-api/package.json
index 9c31bc638582a..fbbf457a4986d 100644
--- a/packages/desktop-api/package.json
+++ b/packages/desktop-api/package.json
@@ -2,6 +2,11 @@
 	"$schema": "https://www.schemastore.org/package",
 	"name": "@rocket.chat/desktop-api",
 	"version": "1.3.0",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
+		"directory": "packages/desktop-api"
+	},
 	"type": "module",
 	"exports": {
 		".": {
diff --git a/packages/emitter/package.json b/packages/emitter/package.json
index 3a9cb36d7d3ce..e81cba88a91ff 100644
--- a/packages/emitter/package.json
+++ b/packages/emitter/package.json
@@ -10,7 +10,8 @@
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/RocketChat/Rocket.Chat.git"
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
+		"directory": "packages/emitter"
 	},
 	"license": "MIT",
 	"author": {
@@ -44,9 +45,6 @@
 		"ts-jest": "~29.4.11",
 		"typescript": "~5.9.3"
 	},
-	"publishConfig": {
-		"access": "public"
-	},
 	"volta": {
 		"extends": "../../package.json"
 	}
diff --git a/packages/eslint-config/package.json b/packages/eslint-config/package.json
index 37be7d9a7155f..0cd266db1ac5e 100644
--- a/packages/eslint-config/package.json
+++ b/packages/eslint-config/package.json
@@ -2,6 +2,11 @@
 	"name": "@rocket.chat/eslint-config",
 	"version": "0.8.0",
 	"description": "Rocket.Chat's JS/TS ESLint config",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
+		"directory": "packages/eslint-config"
+	},
 	"type": "module",
 	"main": "./index.js",
 	"exports": {
diff --git a/packages/fuselage-ui-kit/package.json b/packages/fuselage-ui-kit/package.json
index 820a7cffb80c7..62fcf735ea9f3 100644
--- a/packages/fuselage-ui-kit/package.json
+++ b/packages/fuselage-ui-kit/package.json
@@ -3,13 +3,13 @@
 	"version": "33.0.0",
 	"private": true,
 	"description": "UiKit elements for Rocket.Chat Apps built under Fuselage design system",
-	"homepage": "https://rocketchat.github.io/Rocket.Chat.Fuselage/",
+	"homepage": "https://github.com/RocketChat/Rocket.Chat#readme",
 	"bugs": {
-		"url": "https://github.com/RocketChat/fuselage/issues"
+		"url": "https://github.com/RocketChat/Rocket.Chat/issues"
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/RocketChat/fuselage.git",
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
 		"directory": "packages/fuselage-ui-kit"
 	},
 	"license": "MIT",
@@ -101,8 +101,5 @@
 	},
 	"volta": {
 		"extends": "../../package.json"
-	},
-	"publishConfig": {
-		"access": "public"
 	}
 }
diff --git a/packages/livechat/package.json b/packages/livechat/package.json
index 475572affcd22..aeb0ebe5e2c87 100644
--- a/packages/livechat/package.json
+++ b/packages/livechat/package.json
@@ -4,7 +4,7 @@
 	"homepage": "https://rocket.chat",
 	"repository": {
 		"type": "git",
-		"url": "https://github.com/RocketChat/Rocket.Chat",
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
 		"directory": "packages/livechat"
 	},
 	"license": "MIT",
diff --git a/packages/media-signaling/package.json b/packages/media-signaling/package.json
index b2daac0c4212e..9eb638fd45123 100644
--- a/packages/media-signaling/package.json
+++ b/packages/media-signaling/package.json
@@ -12,9 +12,6 @@
 	"bugs": {
 		"url": "https://github.com/RocketChat/Rocket.Chat/issues"
 	},
-	"publishConfig": {
-		"access": "public"
-	},
 	"main": "./dist/index.js",
 	"typings": "./dist/index.d.ts",
 	"files": [
diff --git a/packages/memo/package.json b/packages/memo/package.json
index 5fef6aa09b862..31a5d664c9628 100644
--- a/packages/memo/package.json
+++ b/packages/memo/package.json
@@ -43,8 +43,5 @@
 	},
 	"volta": {
 		"extends": "../../package.json"
-	},
-	"publishConfig": {
-		"access": "public"
 	}
 }
diff --git a/packages/message-parser/package.json b/packages/message-parser/package.json
index e825de9648617..5b56fbc56934d 100644
--- a/packages/message-parser/package.json
+++ b/packages/message-parser/package.json
@@ -2,13 +2,13 @@
 	"name": "@rocket.chat/message-parser",
 	"version": "0.32.0",
 	"description": "Rocket.Chat parser for messages",
-	"homepage": "https://github.com/RocketChat/fuselage#readme",
+	"homepage": "https://github.com/RocketChat/Rocket.Chat#readme",
 	"bugs": {
-		"url": "https://github.com/RocketChat/fuselage/issues"
+		"url": "https://github.com/RocketChat/Rocket.Chat/issues"
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/RocketChat/fuselage.git",
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
 		"directory": "packages/message-parser"
 	},
 	"license": "MIT",
@@ -71,8 +71,5 @@
 	},
 	"volta": {
 		"extends": "../../package.json"
-	},
-	"publishConfig": {
-		"access": "public"
 	}
 }
diff --git a/packages/mp3-encoder/package.json b/packages/mp3-encoder/package.json
index cf91bcba38fd9..b82f77741f498 100644
--- a/packages/mp3-encoder/package.json
+++ b/packages/mp3-encoder/package.json
@@ -50,8 +50,5 @@
 		"ts-jest": "~29.4.12",
 		"typedoc": "~0.28.20",
 		"typescript": "~5.9.3"
-	},
-	"publishConfig": {
-		"access": "public"
 	}
 }
diff --git a/packages/peggy-loader/package.json b/packages/peggy-loader/package.json
index b537643d23029..5296ce06d9df4 100644
--- a/packages/peggy-loader/package.json
+++ b/packages/peggy-loader/package.json
@@ -7,13 +7,13 @@
 		"loader",
 		"webpack"
 	],
-	"homepage": "https://github.com/RocketChat/fuselage#readme",
+	"homepage": "https://github.com/RocketChat/Rocket.Chat#readme",
 	"bugs": {
-		"url": "https://github.com/RocketChat/fuselage/issues"
+		"url": "https://github.com/RocketChat/Rocket.Chat/issues"
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/RocketChat/fuselage.git",
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
 		"directory": "packages/peggy-loader"
 	},
 	"license": "MIT",
@@ -49,8 +49,5 @@
 	},
 	"volta": {
 		"extends": "../../package.json"
-	},
-	"publishConfig": {
-		"access": "public"
 	}
 }
diff --git a/packages/release-action/action.yml b/packages/release-action/action.yml
index 23d7382aab6d8..34f0c93bf1897 100644
--- a/packages/release-action/action.yml
+++ b/packages/release-action/action.yml
@@ -10,7 +10,7 @@ inputs:
     required: false
 
 runs:
-  using: "node20"
+  using: "node24"
   main: "dist/index.js"
 
 branding:
diff --git a/packages/release-action/package.json b/packages/release-action/package.json
index 3045639607d77..cf18f5663e598 100644
--- a/packages/release-action/package.json
+++ b/packages/release-action/package.json
@@ -4,7 +4,7 @@
 	"private": true,
 	"main": "dist/index.js",
 	"scripts": {
-		"build": "tsc --noEmit && esbuild src/index.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/index.js",
+		"build": "tsc --noEmit && esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.js",
 		"lint": "eslint .",
 		"lint:fix": "eslint --fix src"
 	},
@@ -26,7 +26,6 @@
 		"eslint": "~9.39.5",
 		"typescript": "~5.9.3"
 	},
-	"packageManager": "yarn@4.12.0",
 	"volta": {
 		"extends": "../../package.json"
 	}
diff --git a/packages/release-action/src/createNpmFile.ts b/packages/release-action/src/createNpmFile.ts
index 67c0112e526c4..ad46a231b61b3 100644
--- a/packages/release-action/src/createNpmFile.ts
+++ b/packages/release-action/src/createNpmFile.ts
@@ -4,6 +4,13 @@ import fsPromise from 'node:fs/promises';
 import * as core from '@actions/core';
 
 export async function createNpmFile() {
+	// With trusted publishing (OIDC) there is no token, and a bogus auth line in .npmrc
+	// takes precedence over the OIDC exchange, so leave the file alone.
+	if (!process.env.NPM_TOKEN) {
+		core.info('No NPM_TOKEN provided, relying on the registry authentication already in place');
+		return;
+	}
+
 	const userNpmrcPath = `${process.env.HOME}/.npmrc`;
 
 	if (fs.existsSync(userNpmrcPath)) {
diff --git a/packages/rest-typings/package.json b/packages/rest-typings/package.json
index bbeb9384a31a9..c1b777bd7c2e2 100644
--- a/packages/rest-typings/package.json
+++ b/packages/rest-typings/package.json
@@ -1,6 +1,11 @@
 {
 	"name": "@rocket.chat/rest-typings",
 	"version": "8.9.0-develop",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
+		"directory": "packages/rest-typings"
+	},
 	"main": "./dist/index.js",
 	"typings": "./dist/index.d.ts",
 	"files": [
diff --git a/packages/ui-kit/package.json b/packages/ui-kit/package.json
index 90cc64fb96426..8eb19e0e4d335 100644
--- a/packages/ui-kit/package.json
+++ b/packages/ui-kit/package.json
@@ -8,7 +8,8 @@
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/RocketChat/Rocket.Chat.git"
+		"url": "git+https://github.com/RocketChat/Rocket.Chat.git",
+		"directory": "packages/ui-kit"
 	},
 	"license": "MIT",
 	"author": {
@@ -52,8 +53,5 @@
 	},
 	"volta": {
 		"extends": "../../package.json"
-	},
-	"publishConfig": {
-		"access": "public"
 	}
 }