diff --git a/.github/workflows/publish-public.yml b/.github/workflows/publish-public.yml
index 44cbed36b0..8d7b92902f 100644
--- a/.github/workflows/publish-public.yml
+++ b/.github/workflows/publish-public.yml
@@ -18,6 +18,14 @@ on:
         default: ""
         description: The version of the packages to publish publicly
         required: false
+      dry-run:
+        type: boolean
+        default: false
+        description: Run the pipeline but don't actually publish anything.
+
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
 
 jobs:
   copy-nuget-packages:
@@ -46,7 +54,8 @@ jobs:
             -nuGetOrgApiKey "${{ secrets.NUGET_ORG_API_KEY }}" `
             -include '${{ inputs.include }}' `
             -exclude '${{ inputs.exclude }}' `
-            -version "${{ inputs.version }}"
+            -version '${{ inputs.version }}' `
+            -dryRun ${{ inputs.dry-run && '$true' || '$false' }}
         shell: pwsh
 
   copy-npm-packages:
@@ -90,17 +99,15 @@ jobs:
           ls
         working-directory: ./artifacts
 
-      - name: Set public npm registry
-        if: steps.include-check.outputs.match == 'true'
-        run: >
-          ${{ github.workspace }}/ci/scripts/Set-NpmRegistry.ps1 `
-            -targetDirectory "." `
-            -registry "https://registry.npmjs.org/" `
-            -authToken "${{ secrets.PUBLIC_NPM_PAT }}"
-        shell: pwsh
-        working-directory: ./artifacts/node_modules/dotvvm-types
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Upgrade npm
+        run: npm install -g npm@latest
 
       - name: Publish dotvvm-types to registry.npmjs.org
         if: steps.include-check.outputs.match == 'true'
-        run: npm publish --verbose
+        run: NODE_AUTH_TOKEN="" npm publish --verbose ${{ inputs.dry-run && '--dry-run' || '' }} --tag latest
         working-directory: ./artifacts/node_modules/dotvvm-types
diff --git a/ci/scripts/Copy-NuGetPackages.ps1 b/ci/scripts/Copy-NuGetPackages.ps1
index 62578697ec..beb8e7ae78 100644
--- a/ci/scripts/Copy-NuGetPackages.ps1
+++ b/ci/scripts/Copy-NuGetPackages.ps1
@@ -4,7 +4,8 @@ param(
     [string]$internalNuGetFeedName = "riganti",
     [string]$include = "*",
     [string]$exclude = "",
-    [string]$version = ""
+    [string]$version = "",
+    [bool]$dryRun = $false
 )
 
 if (-not (Test-Path "$root")) {
@@ -73,10 +74,14 @@ try {
 Write-Host "::group::Pushing packages to NuGet.org"
 try {
     foreach ($package in (Get-ChildItem "$packagesDir/**/*.nupkg")) {
-        nuget push "$($package.FullName)" `
-            -Source "nuget.org" `
-            -ApiKey "$nuGetOrgApiKey" `
-            -NonInteractive
+        if (!($dryRun)) {
+            nuget push "$($package.FullName)" `
+                -Source "nuget.org" `
+                -ApiKey "$nuGetOrgApiKey" `
+                -NonInteractive
+        } else {
+            Write-Host "Skipping 'nuget push' because dry run is active."
+        }
     }
 } finally {
     Write-Host "::endgroup::"
diff --git a/package-lock.json b/package-lock.json
new file mode 100644
index 0000000000..dbce0f3886
--- /dev/null
+++ b/package-lock.json
@@ -0,0 +1,6 @@
+{
+  "name": "dotvvm",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {}
+}