diff --git a/scripts/release.sh b/scripts/release.sh
index 78250791..5eff8bbd 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -250,9 +250,13 @@ publish_package() {
   final_tgz="$(find "$work_dir" -maxdepth 1 -name '*.tgz' | sort | tail -1)"
   [ -z "$final_tgz" ] && { warn "Repack failed for $name@$version — skipping"; SKIPPED+=("$name@$version (repack failed)"); return; }
 
+  # Write a temp .npmrc with the auth token — inline --// flags are unreliable
+  local tmp_npmrc="$work_dir/.npmrc"
+  printf '//%s:_authToken=%s\n' "$AUTH_TARGET" "$TOKEN" > "$tmp_npmrc"
+
   if npm publish "$final_tgz" \
       --registry "$REGISTRY_URL" \
-      "--//${AUTH_TARGET}:_authToken=${TOKEN}" 2>&1; then
+      --userconfig "$tmp_npmrc" 2>&1; then
     ok "$name@$version published"
     PUBLISHED+=("$name@$version")
   else