diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc7359d..d5af8d2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -63,9 +63,20 @@ jobs:
 
       - name: Install Playwright browsers
         if: steps.playwright-cache.outputs.cache-hit != 'true'
-        # A stalled download otherwise holds the job until its 40-minute timeout (seen on PR #15).
-        timeout-minutes: 10
-        run: npx playwright install --with-deps chromium firefox webkit
+        # The Ubuntu mirror behind --with-deps sometimes stalls (PRs #15, #16, #17). apt retries
+        # stalled downloads and waits for the dpkg lock; each attempt gets 6 minutes, and the
+        # root apt-get that timeout cannot reach is stopped before the next one.
+        timeout-minutes: 20
+        run: |
+          printf 'Acquire::Retries "5";\nAcquire::http::Timeout "30";\nDPkg::Lock::Timeout "120";\n' \
+            | sudo tee /etc/apt/apt.conf.d/80-ci-retries > /dev/null
+          for attempt in 1 2 3; do
+            timeout 6m npx playwright install --with-deps chromium firefox webkit && exit 0
+            echo "Playwright install attempt $attempt stalled or failed, retrying"
+            sudo pkill -9 -x apt-get || true
+            sudo dpkg --configure -a || true
+          done
+          exit 1
 
       - name: Install Playwright system dependencies
         if: steps.playwright-cache.outputs.cache-hit == 'true'
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index d62e557..677d2b8 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -11,6 +11,9 @@ jobs:
 
     permissions:
       contents: read
+      # Trusted publishing (OIDC): npm accepts this repo + this workflow file name,
+      # so renaming npm-publish.yml needs the same change on the npm package settings.
+      id-token: write
 
     steps:
       - name: Checkout
@@ -23,6 +26,10 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
 
+      - name: Update npm for trusted publishing
+        # Node 22 ships npm 10; trusted publishing needs npm 11.5.1 or later.
+        run: npm install -g npm@11
+
       - name: Install dependencies
         run: npm ci
 
@@ -35,8 +42,21 @@ jobs:
       - name: Unit tests
         run: npm test
 
-      - name: Install Chromium for browser tests
-        run: npx playwright install --with-deps chromium firefox webkit
+      - name: Install Playwright browsers
+        # The Ubuntu mirror behind --with-deps sometimes stalls (PRs #15, #16, #17). apt retries
+        # stalled downloads and waits for the dpkg lock; each attempt gets 6 minutes, and the
+        # root apt-get that timeout cannot reach is stopped before the next one.
+        timeout-minutes: 20
+        run: |
+          printf 'Acquire::Retries "5";\nAcquire::http::Timeout "30";\nDPkg::Lock::Timeout "120";\n' \
+            | sudo tee /etc/apt/apt.conf.d/80-ci-retries > /dev/null
+          for attempt in 1 2 3; do
+            timeout 6m npx playwright install --with-deps chromium firefox webkit && exit 0
+            echo "Playwright install attempt $attempt stalled or failed, retrying"
+            sudo pkill -9 -x apt-get || true
+            sudo dpkg --configure -a || true
+          done
+          exit 1
 
       - name: Browser tests
         run: npm run test:browser
@@ -69,5 +89,3 @@ jobs:
 
       - name: Publish
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}