diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 57dcd40..85e00df 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,9 +27,10 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      issues: write
-      pull-requests: write
+      contents: write # Publish GitHub Releases
+      issues: write # Comment on issues
+      pull-requests: write # Comment on PRs
+      id-token: write # OIDC token for npm provenance
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/release.config.mjs b/release.config.mjs
index b93da5d..4c85d76 100644
--- a/release.config.mjs
+++ b/release.config.mjs
@@ -12,7 +12,7 @@ export default {
 		[
 			'@semantic-release/exec',
 			{
-				prepareCmd: 'cp package.json README.md LICENSE* dist',
+				prepareCmd: 'mkdir -p dist && cp package.json README.md LICENSE* dist',
 			},
 		],
 		'@semantic-release/git',