diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 770271b..98f5f5d 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -1,5 +1,7 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
+# Tests every push and pull request; publishes to npm when main has a
+# package.json version newer than the one on npm.
+# Publishing uses npm trusted publishing (OIDC): no token, npm trusts this
+# workflow file (npm-publish.yml) of edge-ml/javascript.
 
 name: Node.js Package
 
@@ -12,6 +14,8 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -27,7 +31,12 @@ jobs:
 
   publish-npm:
     needs: build
+    # only from main, never from a pull request
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # OIDC token for npm trusted publishing
     steps:
       - uses: actions/checkout@v4
       - id: check
@@ -39,15 +48,15 @@ jobs:
       - uses: actions/setup-node@v4
         if: steps.check.outputs.changed == 'true'
         with:
-          node-version: 20
-          registry-url: https://registry.npmjs.org/
+          node-version: 24
+      # trusted publishing needs npm >= 11.5.1
+      - run: npm install -g npm@^11.5.1 && npm --version
+        if: steps.check.outputs.changed == 'true'
       - run: npm ci
         if: steps.check.outputs.changed == 'true'
         env:
           ONNXRUNTIME_NODE_INSTALL_CUDA: skip
       - run: npm publish
         if: steps.check.outputs.changed == 'true'
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
       - name: Version unchanged
         run: 'echo "${{steps.check.outputs.changed}}"'
diff --git a/README.md b/README.md
index 6462c3d..f867f10 100644
--- a/README.md
+++ b/README.md
@@ -220,7 +220,7 @@ catalog.quantities.map((q) => [q.id, q.defaultUnit, q.units.map((u) => u.id)]);
 // [["acceleration", "m/s^2", ["m/s^2", "g", "mg", "cm/s^2"]], ["angular_velocity", "deg/s", ["deg/s", "rad/s", "rpm"]], ...]
 ```
 
-## Unreleased: units
+## 4.1.0: units
 
 - Time-series can carry a unit and quantity when uploading (`{ name, unit, quantity }` instead of a name).
 - `OnnxPredictor` converts declared sensor units to the units the model expects (`units` option, `setUnits`, `inputUnits`), and throws a `UnitError` for units it can't convert.
diff --git a/package-lock.json b/package-lock.json
index 93fe603..f016db5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "edge-ml",
-    "version": "4.0.1",
+    "version": "4.1.0",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "edge-ml",
-            "version": "4.0.1",
+            "version": "4.1.0",
             "license": "MIT",
             "devDependencies": {
                 "@rollup/plugin-alias": "^5.1.1",
diff --git a/package.json b/package.json
index 7aa7826..567bb9f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "edge-ml",
-    "version": "4.0.1",
+    "version": "4.1.0",
     "description": "JavaScript library for edge-ml (https://github.com/edge-ml): collect data, train models and run them in the browser or Node.js",
     "main": "dist/index.js",
     "module": "dist/index.mjs",