diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f438006..8fa312d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -57,7 +57,7 @@ jobs:
 
       # package provenance requires latest npm, alternatively we can probably use node 18 above instead
       - name: Install latest npm
-        run: npm install -g npm@latest
+        run: npm install -g npm@9
 
       - name: Install packages
         run: yarn install --frozen-lockfile