diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e4e1095..6b0f56f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -51,9 +51,13 @@ jobs:
     - name: Testing
       run: pnpm test
 
-    - name: Publish
-      # No NPM_TOKEN: pnpm authenticates via OIDC trusted publishing and
-      # generates provenance attestations from the OIDC identity.
-      # --no-git-checks is required because the release runs from a detached
-      # tag checkout rather than a branch.
-      run: pnpm publish --provenance --no-git-checks --ignore-scripts
+    - name: Pack
+      run: |
+        mkdir -p packed
+        pnpm pack --pack-destination packed
+        ls -la packed
+
+    - name: Stage publish
+      # OIDC stages the tarball. This job does not use an npm token.
+      # --no-git-checks is required. The release checkout is a detached tag.
+      run: pnpm stage publish ./packed/*.tgz --access public --provenance --no-git-checks
diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md
index 8dd3b6f..4ef9de9 100644
--- a/DEFENSE_IN_DEPTH.md
+++ b/DEFENSE_IN_DEPTH.md
@@ -30,15 +30,15 @@ Profile: npm library · public
 - [x] Every action pinned to a full commit SHA (`npx actions-up`) — verified 2026-10-08
 - [x] Every job installs Socket Firewall (`SocketDev/action` SHA-pinned, `firewall-version` pinned); `pnpm install` / `npm install` run as `sfw pnpm install` / `sfw npm install` — PR #167
 - [x] `.github/workflows/check-workflows.yaml` lints workflows with zizmor on every PR — PR #168
-- [ ] Workflow `name:` and job `name:` contain no spaces (kebab-case) so they can be set as required status checks (PR #169 pending)
+- [x] Workflow `name:` and job `name:` contain no spaces (kebab-case) so they can be set as required status checks — PR #169
 - [x] `persist-credentials: false` on checkouts that don't push — PR #168
 - [x] No `pull_request_target` on workflows that run untrusted PR code — verified 2026-10-08
 - [x] Artifact-publishing workflows disable `actions/setup-node` default caching (`package-manager-cache: false`) to prevent cache poisoning — PR #168
-- [ ] No npm tokens (or other registry credentials) in Actions secrets
+- [x] No npm tokens (or other registry credentials) in Actions secrets — verified 2026-10-11
 
 ## 5. npm publishing — npm libraries only
 - [ ] OIDC trusted publishing configured **stage-only** on npmjs.com for the publish workflow — it can stage, never publish live (manual)
-- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks`
+- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` (PR #170 pending)
 - [ ] Maintainer promotes staged versions with 2FA (manual)
 - [ ] Drydock connected — staged releases reviewed before promotion (manual)
 - [ ] No direct publish rights: package requires 2FA and disallows tokens (manual)