diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2578df232..bd67fbc87 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,8 @@ jobs:
   library:
     name: Library — lint / test / build
     runs-on: ubuntu-latest
+    env:
+      LIBS: chat,langgraph,ag-ui,render,a2ui,partial-json,licensing
     steps:
       - uses: actions/checkout@v6.0.2
       - uses: actions/setup-node@v6.3.0
@@ -17,9 +19,9 @@ jobs:
           node-version: 22
           cache: npm
       - run: npm ci
-      - run: npx nx lint langgraph
-      - run: npx nx test langgraph --coverage
-      - run: npx nx build langgraph --configuration=production
+      - run: npx nx run-many -t lint --projects=$LIBS
+      - run: npx nx run-many -t test --projects=$LIBS --coverage
+      - run: npx nx run-many -t build --projects=$LIBS --configuration=production
 
   website:
     name: Website — lint / build
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index eef1883eb..7272a60c1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,6 +29,12 @@ jobs:
 
       - run: npm ci
 
+      # Trusted publishing requires npm CLI 11.5.1+. Node 22's bundled npm
+      # is 10.x which has partial OIDC support but doesn't fully implement
+      # the trusted-publishing flow against npm registry's OIDC endpoint.
+      - name: Upgrade npm to support trusted publishing
+        run: npm install -g npm@latest
+
       - name: Lint, test, build publishable projects
         run: npx nx run-many -t lint,test,build --projects=$NPM_PUBLISHABLE_PROJECTS --skip-nx-cache