diff --git a/.github/actions/setup-publish/action.yml b/.github/actions/setup-publish/action.yml
index 3f96b10b..a0b0c85e 100644
--- a/.github/actions/setup-publish/action.yml
+++ b/.github/actions/setup-publish/action.yml
@@ -21,9 +21,9 @@ runs:
         cache: 'pnpm' # package manager for caching
         registry-url: 'https://registry.npmjs.org'
 
-    # Update npm to latest for provenance
+    # Update npm to latest release compatible with our pinned Node version, for provenance
     - name: Update npm
-      run: npm install -g npm@latest
+      run: npm install -g npm@10
       shell: bash
 
     - name: Install dependencies from lockfile