diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 508958713a..d73862dd22 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -68,32 +68,15 @@ jobs:
           path: ${{ steps.package.outputs.vsix }}
           if-no-files-found: error
 
-  # Job-level `if` can't read secrets, and the package job runs dependency
-  # code, so a separate job reports which marketplace tokens are set.
-  tokens:
-    name: Check Marketplace Tokens
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    outputs:
-      vsce: ${{ steps.check.outputs.vsce }}
-      ovsx: ${{ steps.check.outputs.ovsx }}
-    steps:
-      - name: Check which tokens are set
-        id: check
-        env:
-          VSCE_PAT: ${{ secrets.VSCE_PAT }}
-          OVSX_PAT: ${{ secrets.OVSX_PAT }}
-        run: |
-          echo "vsce=$([ -n "$VSCE_PAT" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-          echo "ovsx=$([ -n "$OVSX_PAT" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-
   publish-vscode:
     name: Publish to VS Marketplace
-    needs: [package, tokens]
-    if: needs.tokens.outputs.vsce == 'true'
+    needs: package
+    if: github.repository == 'coder/vscode-coder'
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     environment: publish
+    permissions:
+      id-token: write # Allows generating an OIDC token.
     steps:
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -118,14 +101,13 @@ jobs:
 
       - name: Publish to VS Marketplace
         env:
-          VSCE_PAT: ${{ secrets.VSCE_PAT }}
           VSIX: ${{ needs.package.outputs.vsix }}
-        run: vsce publish $PRE_RELEASE_FLAG --packagePath "$VSIX"
+        run: vsce publish $PRE_RELEASE_FLAG --packagePath "$VSIX" --oidc
 
   publish-ovsx:
     name: Publish to Open VSX
-    needs: [package, tokens]
-    if: needs.tokens.outputs.ovsx == 'true'
+    needs: package
+    if: github.repository == 'coder/vscode-coder'
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     environment: publish
diff --git a/package.json b/package.json
index 4a1b4711f0..38609b33b2 100644
--- a/package.json
+++ b/package.json
@@ -849,7 +849,7 @@
 		"@vscode/codicons": "catalog:",
 		"@vscode/test-cli": "^0.0.15",
 		"@vscode/test-electron": "^3.1.0",
-		"@vscode/vsce": "^4.0.0",
+		"@vscode/vsce": "^4.1.0",
 		"babel-plugin-react-compiler": "catalog:",
 		"bufferutil": "^4.1.0",
 		"coder": "link:vendor/coder",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c74a2ddcd3..2aa366a5f4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -382,8 +382,8 @@ importers:
         specifier: ^3.1.0
         version: 3.1.0(supports-color@8.1.1)
       '@vscode/vsce':
-        specifier: ^4.0.0
-        version: 4.0.0(supports-color@8.1.1)
+        specifier: ^4.1.0
+        version: 4.1.0(supports-color@8.1.1)
       babel-plugin-react-compiler:
         specifier: 'catalog:'
         version: 1.0.0
@@ -2965,8 +2965,8 @@ packages:
   '@vscode/vsce-sign@2.1.0':
     resolution: {integrity: sha512-9AQrqazrBgTgRSuwleLVXUrIUphY02/SFCh2TKYoLV/xifJAdblhdmEmw5gUrYSPQ3sRwNs9iyCMD14sATEE6g==}
 
-  '@vscode/vsce@4.0.0':
-    resolution: {integrity: sha512-NImwuLaenMmb5D5Jer9/lzi/F9ZQUBOp8Azhj/BVYcTFgixv8KehFXqEUDjQlD2tAiw2E6dDGyjTuAB//di60A==}
+  '@vscode/vsce@4.1.0':
+    resolution: {integrity: sha512-iWNykEfLWTAU7FC2iBiE0vJvnJDpGm3GlL89dsBtRs62F+8tkPtq80Imi0QSFHjNBWu4QIdYII+3F9v/ZQRExw==}
     engines: {node: '>= 22'}
     hasBin: true
 
@@ -7434,7 +7434,7 @@ snapshots:
       '@vscode/vsce-sign-win32-arm64': 2.0.6
       '@vscode/vsce-sign-win32-x64': 2.0.6
 
-  '@vscode/vsce@4.0.0(supports-color@8.1.1)':
+  '@vscode/vsce@4.1.0(supports-color@8.1.1)':
     dependencies:
       '@azure/identity': 4.14.0(supports-color@8.1.1)
       '@napi-rs/keyring': 1.3.0