diff --git a/scripts/acpx-patch-packaging.test.mjs b/scripts/acpx-patch-packaging.test.mjs
index 57379a4fb6..d51ca8e7ef 100644
--- a/scripts/acpx-patch-packaging.test.mjs
+++ b/scripts/acpx-patch-packaging.test.mjs
@@ -34,7 +34,9 @@ test("bundled package staging materializes publishConfig entrypoints", () => {
 });
 
 test("bundled package dry runs preview without querying published versions", () => {
-  assert.match(releaseScript, /run_bundled_npm pack --pack-destination "\$publish_dir"/);
-  assert.match(releaseLib, /BUNDLED_NPM_VERSION="10\.9\.7"/);
-  assert.match(releaseLib, /npx --yes "npm@\$BUNDLED_NPM_VERSION"/);
+  assert.match(releaseScript, /run_bundled_npm_pack pack --pack-destination "\$publish_dir"/);
+  assert.match(releaseLib, /BUNDLED_NPM_PACK_VERSION="10\.9\.7"/);
+  assert.match(releaseLib, /BUNDLED_NPM_PUBLISH_VERSION="11\.16\.0"/);
+  assert.match(releaseLib, /npx --yes "npm@\$BUNDLED_NPM_PACK_VERSION"/);
+  assert.match(releaseLib, /npx --yes "npm@\$BUNDLED_NPM_PUBLISH_VERSION"/);
 });
diff --git a/scripts/release-lib.sh b/scripts/release-lib.sh
index 7cd7ec55a3..927c36a96e 100644
--- a/scripts/release-lib.sh
+++ b/scripts/release-lib.sh
@@ -310,10 +310,15 @@ package_publish_tool() {
   '
 }
 
-BUNDLED_NPM_VERSION="10.9.7"
+BUNDLED_NPM_PACK_VERSION="10.9.7"
+BUNDLED_NPM_PUBLISH_VERSION="11.16.0"
 
-run_bundled_npm() {
-  npx --yes "npm@$BUNDLED_NPM_VERSION" "$@"
+run_bundled_npm_pack() {
+  npx --yes "npm@$BUNDLED_NPM_PACK_VERSION" "$@"
+}
+
+run_bundled_npm_publish() {
+  npx --yes "npm@$BUNDLED_NPM_PUBLISH_VERSION" "$@"
 }
 
 run_package_publish() {
@@ -323,9 +328,9 @@ run_package_publish() {
 
   if [ "$publish_tool" = "npm" ]; then
     if [ "$disable_provenance" = "true" ]; then
-      run_bundled_npm publish --tag "$dist_tag" --access public --provenance=false
+      run_bundled_npm_publish publish --tag "$dist_tag" --access public --provenance=false
     else
-      run_bundled_npm publish --tag "$dist_tag" --access public
+      run_bundled_npm_publish publish --tag "$dist_tag" --access public
     fi
     return
   fi
diff --git a/scripts/release-lib.test.mjs b/scripts/release-lib.test.mjs
index efb901f952..e98128d8d6 100644
--- a/scripts/release-lib.test.mjs
+++ b/scripts/release-lib.test.mjs
@@ -91,7 +91,7 @@ exit 1
 set -euo pipefail
 printf 'npx %s\n' "$*" >> "$FAKE_CALL_LOG"
 [ "$1" = "--yes" ] && shift
-[ "$1" = "npm@10.9.7" ] && shift
+[ "$1" = "npm@11.16.0" ] && shift
 exec npm "$@"
 `,
   );
@@ -141,11 +141,11 @@ test("publish_package_to_npm returns after a successful pnpm publish", () => {
   assert.doesNotMatch(result.calls, /--provenance=false/);
 });
 
-test("publish_package_to_npm uses npm for bundled dependencies", () => {
+test("publish_package_to_npm uses trusted-publishing-capable npm for bundled dependencies", () => {
   const result = runPublishHelper({ pnpmMode: "success", publishTool: "npm" });
 
   assert.equal(result.status, 0);
-  assert.match(result.calls, /^npx --yes npm@10\.9\.7 publish --tag canary --access public$/m);
+  assert.match(result.calls, /^npx --yes npm@11\.16\.0 publish --tag canary --access public$/m);
   assert.match(result.calls, /^npm publish --tag canary --access public$/m);
   assert.doesNotMatch(result.calls, /^pnpm publish/m);
 });
diff --git a/scripts/release.sh b/scripts/release.sh
index 79719107d8..cbdc39d50b 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -262,7 +262,7 @@ if [ "$dry_run" = true ]; then
       publish_dir="$(mktemp -d "${TMPDIR:-/tmp}/paperclip-release-package.XXXXXX")"
       node "$REPO_ROOT/scripts/prepare-bundled-package.mjs" "$REPO_ROOT/$pkg_dir" "$publish_dir"
       cd "$publish_dir"
-      run_bundled_npm pack --pack-destination "$publish_dir" 2>&1 | tail -3
+      run_bundled_npm_pack pack --pack-destination "$publish_dir" 2>&1 | tail -3
       rm -rf "$publish_dir"
     else
       pnpm publish --dry-run --no-git-checks --tag "$DIST_TAG" 2>&1 | tail -3