diff --git a/.github/workflows/jsonrpc-client-npm-package.yml b/.github/workflows/jsonrpc-client-npm-package.yml
index 72e4d7a39..ec76a5bf9 100644
--- a/.github/workflows/jsonrpc-client-npm-package.yml
+++ b/.github/workflows/jsonrpc-client-npm-package.yml
@@ -1,82 +1,38 @@
-name: "jsonrpc js client build"
+name: "Publish @deltachat/jsonrpc-client"
 on:
-  pull_request:
-  push:
-    tags:
-      - "*"
-      - "!py-*"
+  workflow_dispatch:
+  release:
+    types: [published]
 
 jobs:
   pack-module:
-    name: "Package @deltachat/jsonrpc-client and upload to download.delta.chat"
+    name: "Publish @deltachat/jsonrpc-client"
     runs-on: ubuntu-20.04
+    permissions:
+      id-token: write
+      contents: read
     steps:
-      - name: Install tree
-        run: sudo apt install tree
       - uses: actions/checkout@v4
         with:
           show-progress: false
+
       - uses: actions/setup-node@v4
         with:
-          node-version: "18"
-      - name: Get tag
-        id: tag
-        uses: dawidd6/action-get-tag@v1
-        continue-on-error: true
-      - name: Get Pull Request ID
-        id: prepare
-        run: |
-          tag=${{ steps.tag.outputs.tag }}
-          if [ -z "$tag" ]; then
-            node -e "console.log('DELTACHAT_JSONRPC_TAR_GZ=deltachat-jsonrpc-client-' + '${{ github.ref }}'.split('/')[2] + '.tar.gz')" >> $GITHUB_ENV
-          else
-            echo "DELTACHAT_JSONRPC_TAR_GZ=deltachat-jsonrpc-client-${{ steps.tag.outputs.tag }}.tar.gz" >> $GITHUB_ENV
-            echo "No preview will be uploaded this time, but the $tag release"
-          fi
-      - name: System info
-        run: |
-          npm --version
-          node --version
-          echo $DELTACHAT_JSONRPC_TAR_GZ
+          node-version: 20
+          registry-url: "https://registry.npmjs.org"
+
       - name: Install dependencies without running scripts
         working-directory: deltachat-jsonrpc/typescript
         run: npm install --ignore-scripts
+
       - name: Package
-        shell: bash
         working-directory: deltachat-jsonrpc/typescript
         run: |
           npm run build
           npm pack .
-          ls -lah
-          mv $(find deltachat-jsonrpc-client-*) $DELTACHAT_JSONRPC_TAR_GZ
-      - name: Upload Prebuild
-        uses: actions/upload-artifact@v4
-        with:
-          name: deltachat-jsonrpc-client.tgz
-          path: deltachat-jsonrpc/typescript/${{ env.DELTACHAT_JSONRPC_TAR_GZ }}
-      # Upload to download.delta.chat/node/preview/
-      - name: Upload deltachat-jsonrpc-client preview to download.delta.chat/node/preview/
-        if: ${{ ! steps.tag.outputs.tag }}
-        id: upload-preview
-        shell: bash
-        run: |
-          echo -e "${{ secrets.SSH_KEY }}" >__TEMP_INPUT_KEY_FILE
-          chmod 600 __TEMP_INPUT_KEY_FILE
-          scp -o StrictHostKeyChecking=no -v -i __TEMP_INPUT_KEY_FILE -P "22" -r deltachat-jsonrpc/typescript/$DELTACHAT_JSONRPC_TAR_GZ "${{ secrets.USERNAME }}"@"download.delta.chat":"/var/www/html/download/node/preview/"
-        continue-on-error: true
-      - name: Post links to details
-        if: steps.upload-preview.outcome == 'success'
-        run: node ./node/scripts/postLinksToDetails.js
+
+      - name: Publish
+        working-directory: deltachat-jsonrpc/typescript
+        run: npm publish --provenance deltachat-jsonrpc-client-*
         env:
-          URL: preview/${{ env.DELTACHAT_JSONRPC_TAR_GZ }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          MSG_CONTEXT: Download the deltachat-jsonrpc-client.tgz
-      # Upload to download.delta.chat/node/
-      - name: Upload deltachat-jsonrpc-client build to download.delta.chat/node/
-        if: ${{ steps.tag.outputs.tag }}
-        id: upload
-        shell: bash
-        run: |
-          echo -e "${{ secrets.SSH_KEY }}" >__TEMP_INPUT_KEY_FILE
-          chmod 600 __TEMP_INPUT_KEY_FILE
-          scp -o StrictHostKeyChecking=no -v -i __TEMP_INPUT_KEY_FILE -P "22" -r deltachat-jsonrpc/typescript/$DELTACHAT_JSONRPC_TAR_GZ "${{ secrets.USERNAME }}"@"download.delta.chat":"/var/www/html/download/node/"
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}