diff --git a/.github/actions/publish-npm/action.yml b/.github/actions/publish-npm/action.yml
index b7b3a70..b18756d 100644
--- a/.github/actions/publish-npm/action.yml
+++ b/.github/actions/publish-npm/action.yml
@@ -21,11 +21,13 @@ runs:
         ssm_parameter_pairs: '/production/common/releasing/npm/token = NODE_AUTH_TOKEN'
     - uses: ./.github/actions/ci
       name: 'Run CI'
+      env:
+        NODE_AUTH_TOKEN: ${{ env.NODE_AUTH_TOKEN }}
     - name: 'Publish to NPM'
       env:
         LD_RELEASE_IS_PRERELEASE: ${{ inputs.prelease }}
         LD_RELEASE_IS_DRYRUN: ${{ inputs.dry_run }}
-        NODE_AUTH_TOKEN: $NODE_AUTH_TOKEN
+        NODE_AUTH_TOKEN: ${{ env.NODE_AUTH_TOKEN }}
       shell: bash
       run: |
         cd api/sdkmeta-js
diff --git a/.github/workflows/manual-publish-npm.yml b/.github/workflows/manual-publish-npm.yml
index b3be64a..eaf8fcc 100644
--- a/.github/workflows/manual-publish-npm.yml
+++ b/.github/workflows/manual-publish-npm.yml
@@ -16,6 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       id-token: write # Needed to obtain release secrets
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/publish-npm