diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 48329cd..a144bee 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,6 +15,12 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      loglevel:
+        description: 'npm loglevel for the publish step — "verbose" shows the OIDC exchange'
+        default: notice
+        type: choice
+        options: [notice, verbose, silly]
 
 permissions:
   contents: read
@@ -109,7 +115,11 @@ jobs:
         # Provenance is automatic under trusted publishing, but --provenance is
         # kept explicit so the run fails loudly rather than silently publishing
         # an unattested tarball if the exchange ever stops happening.
+        # LOGLEVEL goes through env, never `${{ }}` inside the script body.
+        # `release` events supply no inputs, hence the fallback.
+        env:
+          LOGLEVEL: ${{ inputs.loglevel || 'notice' }}
         run: |
           npm install -g npm@latest
           npm --version
-          npm publish --provenance --access public
+          npm publish --provenance --access public --loglevel "$LOGLEVEL"