diff --git a/.github/scripts/publish_package.sh b/.github/scripts/publish_package.sh
index d4a7bb4e0b..fc23459ffb 100755
--- a/.github/scripts/publish_package.sh
+++ b/.github/scripts/publish_package.sh
@@ -17,7 +17,37 @@
 set -e
 set -u
 
-echo "//wombat-dressing-room.appspot.com/:_authToken=${NPM_AUTH_TOKEN}" >> .npmrc
+touch "$HOME/.npmrc"
+cat << 'NPMRC_EOF' > .npmrc
+registry=https://us-npm.pkg.dev/oss-exit-gate-prod/firebase-admin-node--npm/
+//us-npm.pkg.dev/oss-exit-gate-prod/firebase-admin-node--npm/:always-auth=true
+NPMRC_EOF
+npx --yes --registry=https://registry.npmjs.org/ google-artifactregistry-auth --repo-config=.npmrc --credential-config="$HOME/.npmrc"
 
-readonly UNPREFIXED_VERSION=`echo ${VERSION} | cut -c 2-`
-npm publish ./dist/firebase-admin-${UNPREFIXED_VERSION}.tgz --registry https://wombat-dressing-room.appspot.com
+if [ -z "${VERSION:-}" ]; then
+  echo "Error: VERSION environment variable is not set." >&2
+  exit 1
+fi
+readonly UNPREFIXED_VERSION=$(echo "${VERSION}" | cut -c 2-)
+npm publish "./dist/firebase-admin-${UNPREFIXED_VERSION}.tgz" \
+  --registry="https://us-npm.pkg.dev/oss-exit-gate-prod/firebase-admin-node--npm/" \
+  --provenance=false
+
+cat << MANIFEST_EOF > manifest.json
+{
+  "publish_all": false,
+  "publishing_groups": [
+    {
+      "packages": [
+        {
+          "name": "firebase-admin",
+          "version": "${UNPREFIXED_VERSION}"
+        }
+      ]
+    }
+  ]
+}
+MANIFEST_EOF
+
+gcloud storage cp manifest.json \
+  "gs://oss-exit-gate-prod-projects-bucket/firebase-admin-node/npm/manifests/manifest-${GITHUB_RUN_ID:-manual}-${GITHUB_RUN_ATTEMPT:-1}.json"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b4ef8c68bb..0c87808e18 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -111,6 +111,7 @@ jobs:
     environment: Release
     permissions:
       contents: write
+      id-token: write
 
     steps:
     - name: Checkout source for publish
@@ -147,8 +148,15 @@ jobs:
           --title "Firebase Admin Node.js SDK $RELEASE_VER" \
           --notes "$RELEASE_BODY"
 
-    - name: Publish to NPM
+    - name: Authenticate to Google Cloud (OSS Exit Gate)
+      uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed
+      with:
+        workload_identity_provider: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github'
+
+    - name: Set up Cloud SDK
+      uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f
+
+    - name: Publish to NPM via OSS Exit Gate
       run: ./.github/scripts/publish_package.sh
       env:
-        NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
         VERSION: ${{ steps.preflight.outputs.version }}