diff --git a/.github/workflows/openvsx-publish-release-vsix.yml b/.github/workflows/openvsx-publish-release-vsix.yml
index f366ff7..c98160b 100644
--- a/.github/workflows/openvsx-publish-release-vsix.yml
+++ b/.github/workflows/openvsx-publish-release-vsix.yml
@@ -12,10 +12,16 @@ on:
         required: false
         default: false
         type: boolean
-    secrets:
-      IDEE_OVSX_PAT:
-        description: Open VSX publishing token
-        required: true
+      vsix-name-pattern:
+        description: Glob of downloaded VSIX file names to publish
+        required: false
+        default: '*.vsix'
+        type: string
+      exclude-web-vsix:
+        description: Exclude *-web-* VSIXs from publishing
+        required: false
+        default: 'false'
+        type: string
 
 permissions:
   contents: read
@@ -23,6 +29,11 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # ovsx exchanges this job's OIDC ID token for a short-lived Open VSX publishing token
+      # (--trusted-publishing below) -- without this, there is no token to exchange.
+      id-token: write
     steps:
       - name: Download release VSIXs
         id: release
@@ -33,8 +44,9 @@ jobs:
       - name: Publish VSIXs
         env:
           DRY_RUN: ${{ inputs.dry-run }}
-          IDEE_OVSX_PAT: ${{ secrets.IDEE_OVSX_PAT }}
           PRE_RELEASE: ${{ steps.release.outputs.pre-release }}
+          VSIX_PATTERN: ${{ inputs.vsix-name-pattern }}
+          EXCLUDE_WEB: ${{ inputs.exclude-web-vsix }}
         run: |
           # Open VSX can hang the same way as vsce; retry per VSIX.
           # --skip-duplicate makes a retry a no-op if the first attempt committed.
@@ -54,7 +66,7 @@ jobs:
           }
 
           while IFS= read -r -d '' vsix; do
-            args=("$vsix" -p "$IDEE_OVSX_PAT" --skip-duplicate)
+            args=("$vsix" --trusted-publishing --skip-duplicate)
             pre_release_suffix=''
             if [ "$PRE_RELEASE" = true ]; then
               args+=(--pre-release)
@@ -70,4 +82,10 @@ jobs:
               echo "::error::Failed to publish $vsix after 3 attempts"
               exit 1
             fi
-          done < <(find extensions -type f -name '*.vsix' -print0)
+          done < <(
+            if [ "$EXCLUDE_WEB" = "true" ]; then
+              find extensions -type f -name "$VSIX_PATTERN" ! -iname '*-web-*' -print0
+            else
+              find extensions -type f -name "$VSIX_PATTERN" -print0
+            fi
+          )
diff --git a/.github/workflows/vscode-manual-publish.yml b/.github/workflows/vscode-manual-publish.yml
index f81f1d4..b74b4cf 100644
--- a/.github/workflows/vscode-manual-publish.yml
+++ b/.github/workflows/vscode-manual-publish.yml
@@ -5,6 +5,10 @@ name: Manual Publish VS Code Extension
 #   - A nightly GitHub Release (version-tag path — normal workflow)
 #   - A branch CI build artifact (source-run-id path — out-of-band, bypass mandatory)
 #
+# This workflow does NOT publish Open VSX itself -- its `publish` job's ovsx leg is a
+# deliberate no-op (see that job's comment). See "Open VSX Trusted Publishing" in this repo's
+# README for why, and dispatch your own Open VSX publish after this workflow succeeds.
+#
 # Usage from consuming repository:
 #   jobs:
 #     manual-publish:
@@ -22,7 +26,7 @@ name: Manual Publish VS Code Extension
 #       secrets: inherit
 #
 # Requirements - calling repository must have:
-#   - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN, IDEE_OVSX_PAT
+#   - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN
 #   - For CBWeb: MARKETPLACE_DEPLOY_TOKEN and MARKETPLACE_URL variable
 #   - The package manager and lockfile inputs must match the caller repository.
 #   - The shared actions in this repository are resolved from the workflow branch.
@@ -317,6 +321,14 @@ jobs:
               echo "ERROR: source-run-id path requires skip-quality-checks=true (branch CI profiles differ from main)."
               exit 1
             fi
+            # Open VSX publishing is tag-based (the caller dispatches publishOpenVSXTrusted.yml
+            # with a release tag -- see this workflow's header) and there is no GitHub Release,
+            # and therefore no tag, for a branch CI run artifact. Failing loudly here beats the
+            # alternative of silently never publishing to Open VSX for this combination.
+            if [ "$REGISTRIES" = "ovsx" ] || [ "$REGISTRIES" = "all" ]; then
+              echo "ERROR: source-run-id has no GitHub Release for Open VSX's tag-based trusted-publishing dispatch to target. Use registries=vsce for this path."
+              exit 1
+            fi
           fi
 
           # Bypass requires confirmation (case-insensitive)
@@ -794,7 +806,17 @@ jobs:
           fi
           echo "VSIX_PATH=$VSIX_FILE" >> $GITHUB_ENV
 
+      # Open VSX is NOT published here -- see this file's header. The caller dispatches
+      # publishOpenVSXTrusted.yml itself afterward instead, so this leg of the matrix (still
+      # present when registries is ovsx/all, so the job's own success/skip status -- and every
+      # downstream needs.publish.result == 'success' check -- stays exactly as it was) is a
+      # deliberate no-op rather than a removed step.
+      - name: Open VSX is published by the caller, not here
+        if: matrix.publish-tool == 'ovsx'
+        run: echo "Skipping -- the caller dispatches publishOpenVSXTrusted.yml for Open VSX. See this file's header comment."
+
       - name: Publish to ${{ matrix.registry }}
+        if: matrix.publish-tool != 'ovsx'
         uses: salesforcecli/github-workflows/.github/actions/publish-vsix@main
         with:
           vsix-path: ${{ env.VSIX_PATH }}
@@ -803,7 +825,6 @@ jobs:
           dry-run: ${{ inputs.dry-run || 'false' }}
         env:
           VSCE_PERSONAL_ACCESS_TOKEN: ${{ secrets.VSCE_PERSONAL_ACCESS_TOKEN }}
-          OVSX_PAT: ${{ secrets.IDEE_OVSX_PAT }}
 
   publish-to-cbweb-marketplace:
     name: Publish to CBWeb Internal Marketplace
diff --git a/.github/workflows/vscode-promote-prerelease.yml b/.github/workflows/vscode-promote-prerelease.yml
index 3a35377..d71fb1b 100644
--- a/.github/workflows/vscode-promote-prerelease.yml
+++ b/.github/workflows/vscode-promote-prerelease.yml
@@ -1,6 +1,8 @@
 name: Promote Nightly to Pre-release
 
-# Publishes a nightly build to pre-release on VS Code Marketplace and Open VSX.
+# Publishes a nightly build to pre-release on the VS Code Marketplace. Open VSX is NOT published
+# from here. See "Open VSX Trusted Publishing" in this repo's README for why, and use this
+# workflow's `release-tag` output to dispatch your own Open VSX publish afterward.
 #
 # NOTE: Callers should use vscode-find-nightly-candidate.yml and check-ci-status action
 # BEFORE calling this workflow to implement their own gate-check logic.
@@ -36,9 +38,9 @@ name: Promote Nightly to Pre-release
 # Requirements - calling repository must have:
 #   - Nightly tags matching *-nightly.* (e.g., v1.2.3-nightly.20260629)
 #   - GitHub releases for each nightly tag with VSIX file(s) attached
-#   - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN, IDEE_OVSX_PAT
+#   - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN
 #
-# Workflow: downloads VSIX → publishes to both marketplaces → creates tracking tag
+# Workflow: downloads VSIX → publishes to VS Code Marketplace → creates tracking tag
 
 on:
   workflow_call:
@@ -120,14 +122,6 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - registry: vsce
-            publish-tool: vsce
-          - registry: ovsx
-            publish-tool: ovsx
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -151,15 +145,13 @@ jobs:
             --dir ./vsix-artifacts \
             --repo "${{ github.repository }}"
 
-      - name: Publish to ${{ matrix.registry }}
+      - name: Publish to Visual Studio Marketplace
         env:
           NIGHTLY_TAG: ${{ inputs.release-tag }}
           VSIX_PATTERN: ${{ inputs.vsix-name-pattern || '*.vsix' }}
           EXCLUDE_WEB: ${{ inputs.exclude-web-vsix || 'false' }}
-          PUBLISH_TOOL: ${{ matrix.publish-tool }}
           DRY_RUN: ${{ inputs.dry-run || 'false' }}
           VSCE_PERSONAL_ACCESS_TOKEN: ${{ secrets.VSCE_PERSONAL_ACCESS_TOKEN }}
-          OVSX_PAT: ${{ secrets.IDEE_OVSX_PAT }}
         run: |
           set -uo pipefail
 
@@ -177,20 +169,13 @@ jobs:
             exit 1
           fi
 
-          if [ "$PUBLISH_TOOL" = "ovsx" ]; then
-            MARKETPLACE_NAME="Open VSX Registry"
-            TOKEN="$OVSX_PAT"
-          else
-            MARKETPLACE_NAME="Visual Studio Marketplace"
-            TOKEN="$VSCE_PERSONAL_ACCESS_TOKEN"
-          fi
-
+          TOKEN="$VSCE_PERSONAL_ACCESS_TOKEN"
           if [ "$DRY_RUN" != "true" ] && [ -z "$TOKEN" ]; then
-            echo "::error::Token for $PUBLISH_TOOL is not set"
+            echo "::error::Token for vsce is not set"
             exit 1
           fi
 
-          echo "Publishing ${#VSIX_FILES[@]} VSIX(s) as pre-release to $MARKETPLACE_NAME:"
+          echo "Publishing ${#VSIX_FILES[@]} VSIX(s) as pre-release to Visual Studio Marketplace:"
           printf '  %s\n' "${VSIX_FILES[@]}"
 
           RUN_ID="${{ github.run_id }}"
@@ -199,7 +184,7 @@ jobs:
           FAILED=0
 
           # Marketplace gallery requests can sit until typed-rest-client's 180s
-          # socket timeout. vsce/ovsx have no timeout flag; retry per VSIX.
+          # socket timeout. vsce has no timeout flag; retry per VSIX.
           # --skip-duplicate makes a retry a no-op if the first attempt committed.
           publish_with_retry() {
             local attempt
@@ -218,11 +203,11 @@ jobs:
 
           for VSIX in "${VSIX_FILES[@]}"; do
             NAME=$(basename "$VSIX")
-            echo "::group::$NAME → $MARKETPLACE_NAME"
+            echo "::group::$NAME → Visual Studio Marketplace"
 
             # Audit trail (mirrors the publish-vsix action's per-file record)
             HASH=$(sha256sum "$VSIX" 2>/dev/null | cut -d' ' -f1 || echo "unknown")
-            echo "[AUDIT] actor=$ACTOR repo=$REPO run_id=$RUN_ID tool=$PUBLISH_TOOL file=$NAME hash=$HASH pre_release=true dry_run=$DRY_RUN"
+            echo "[AUDIT] actor=$ACTOR repo=$REPO run_id=$RUN_ID tool=vsce file=$NAME hash=$HASH pre_release=true dry_run=$DRY_RUN"
 
             if [ "$DRY_RUN" = "true" ]; then
               echo "🔍 DRY RUN - would publish $NAME (pre-release)"
@@ -230,29 +215,20 @@ jobs:
               continue
             fi
 
-            if [ "$PUBLISH_TOOL" = "vsce" ]; then
-              if VSCE_PAT="$TOKEN" publish_with_retry npx @vscode/vsce publish --packagePath "$VSIX" --skip-duplicate --pre-release; then
-                echo "✅ Published $NAME to $MARKETPLACE_NAME"
-              else
-                echo "::error::Failed to publish $NAME to $MARKETPLACE_NAME"
-                FAILED=1
-              fi
+            if VSCE_PAT="$TOKEN" publish_with_retry npx @vscode/vsce publish --packagePath "$VSIX" --skip-duplicate --pre-release; then
+              echo "✅ Published $NAME to Visual Studio Marketplace"
             else
-              if publish_with_retry npx ovsx publish "$VSIX" -p "$TOKEN" --skip-duplicate --pre-release; then
-                echo "✅ Published $NAME to $MARKETPLACE_NAME"
-              else
-                echo "::error::Failed to publish $NAME to $MARKETPLACE_NAME"
-                FAILED=1
-              fi
+              echo "::error::Failed to publish $NAME to Visual Studio Marketplace"
+              FAILED=1
             fi
             echo "::endgroup::"
           done
 
           if [ "$FAILED" -ne 0 ]; then
-            echo "::error::One or more VSIX publishes failed for $PUBLISH_TOOL"
+            echo "::error::One or more VSIX publishes failed for vsce"
             exit 1
           fi
-          echo "✅ All ${#VSIX_FILES[@]} VSIX(s) processed for $MARKETPLACE_NAME"
+          echo "✅ All ${#VSIX_FILES[@]} VSIX(s) processed for Visual Studio Marketplace"
 
   tag-promoted:
     needs: publish
diff --git a/.github/workflows/vscode-promote-stable.yml b/.github/workflows/vscode-promote-stable.yml
index b141c95..0473db3 100644
--- a/.github/workflows/vscode-promote-stable.yml
+++ b/.github/workflows/vscode-promote-stable.yml
@@ -1,6 +1,9 @@
 name: Promote Pre-release to Stable
 
-# Reusable workflow for promoting a pre-release VS Code extension to stable.
+# Reusable workflow for promoting a pre-release VS Code extension to stable. Publishes to the VS
+# Code Marketplace only -- Open VSX is NOT published from here. See "Open VSX Trusted Publishing"
+# in this repo's README for why, and use this workflow's `release-tag` output to dispatch your
+# own Open VSX publish afterward.
 #
 # Usage from consuming repository:
 #   jobs:
@@ -15,12 +18,20 @@ name: Promote Pre-release to Stable
 #         dry-run: 'false'
 #       secrets: inherit
 #
+#     publish-openvsx:
+#       needs: promote
+#       runs-on: ubuntu-latest
+#       env:
+#         GH_TOKEN: ${{ secrets.IDEE_GH_TOKEN }}
+#       steps:
+#         - run: gh workflow run publishOpenVSXTrusted.yml --repo "${{ github.repository }}" -f release-tag="${{ needs.promote.outputs.release-tag }}"
+#
 # Requirements - calling repository must have:
 #   - marketplace-prerelease-* tracking tags
 #   - Nightly tags matching v{version}-nightly.* pattern
 #   - GitHub releases for each nightly tag with VSIX file(s) attached
 #   - Passing CI checks on the nightly candidate commit
-#   - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN, IDEE_OVSX_PAT
+#   - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN
 #   - The shared actions in this repository are resolved from the workflow branch.
 #   - The package manager and lockfile inputs must match the caller repository.
 #
@@ -28,7 +39,7 @@ name: Promote Pre-release to Stable
 # resolved from this repository so callers do not need duplicate composite actions.
 #
 # Workflow: finds latest pre-release → verifies quality gate → repackages VSIX
-#           → publishes to both marketplaces → creates GitHub release → tags stable
+#           → publishes to VS Code Marketplace → creates GitHub release → tags stable
 #           → commits stable version back to main
 
 on:
@@ -93,6 +104,10 @@ on:
         required: false
         default: 'npm ci'
         type: string
+    outputs:
+      release-tag:
+        description: 'The stable GitHub release tag this run created (e.g. apex-language-server-extension-v1.2.3). Use this to dispatch your own Open VSX trusted-publishing workflow afterward -- see the header comment above.'
+        value: ${{ jobs.create-github-release.outputs.release-tag }}
   workflow_dispatch:
     inputs:
       extension-name:
@@ -336,16 +351,13 @@ jobs:
           name: stable-vsix
           path: ${{ steps.repack.outputs.vsix-path }}
 
+  # Open VSX is NOT published from here -- see this file's header for why (trusted-publisher
+  # match keys off workflow_ref, the run's initiating workflow, and allows only one registration
+  # per extension, so it has to live in whichever single top-level workflow file the caller also
+  # uses for its prerelease's Open VSX publish).
   publish:
     needs: [find-prerelease-candidate, repackage]
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        include:
-          - registry: vsce
-            publish-tool: vsce
-          - registry: ovsx
-            publish-tool: ovsx
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -379,20 +391,21 @@ jobs:
           fi
           echo "VSIX_PATH=$VSIX_FILE" >> $GITHUB_ENV
 
-      - name: Publish to ${{ matrix.registry }}
+      - name: Publish to Visual Studio Marketplace
         uses: salesforcecli/github-workflows/.github/actions/publish-vsix@main
         with:
           vsix-path: ${{ env.VSIX_PATH }}
-          publish-tool: ${{ matrix.publish-tool }}
+          publish-tool: vsce
           pre-release: 'false'
           dry-run: ${{ inputs.dry-run || 'false' }}
         env:
           VSCE_PERSONAL_ACCESS_TOKEN: ${{ secrets.VSCE_PERSONAL_ACCESS_TOKEN }}
-          OVSX_PAT: ${{ secrets.IDEE_OVSX_PAT }}
 
   create-github-release:
     needs: [find-prerelease-candidate, repackage, publish]
     runs-on: ubuntu-latest
+    outputs:
+      release-tag: ${{ steps.release.outputs.release-tag }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -407,6 +420,7 @@ jobs:
           path: ./vsix-artifacts
 
       - name: Create GitHub release for stable version
+        id: release
         env:
           GH_TOKEN: ${{ secrets.IDEE_GH_TOKEN }}
           STABLE_VERSION: ${{ needs.find-prerelease-candidate.outputs.stable-version }}
@@ -427,6 +441,7 @@ jobs:
           # e.g., apex-language-server-extension-1.2.3.vsix -> apex-language-server-extension
           BASE_NAME=$(basename "$VSIX_FILE" .vsix | sed -E 's/-[0-9]+\.[0-9]+\.[0-9]+$//')
           RELEASE_TAG="${BASE_NAME}-v${STABLE_VERSION}"
+          echo "release-tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
           RELEASE_TITLE="${BASE_NAME} v${STABLE_VERSION} (stable)"
           RELEASE_NOTES="## Stable Release v${STABLE_VERSION}
 
diff --git a/README.md b/README.md
index 296127e..6db4eaa 100644
--- a/README.md
+++ b/README.md
@@ -516,6 +516,36 @@ The VS Code workflows follow a modular design:
 3. **Publishing** (`vscode-publish-extensions.yml`) - Complete release pipeline with version bumping and marketplace publishing
 4. **Promotion** (`vscode-promote-prerelease.yml`, `vscode-promote-stable.yml`) - Promotes vetted builds between release channels
 
+### Open VSX Trusted Publishing
+
+Open VSX's trusted-publisher match keys off the OIDC token's `workflow_ref` claim -- the run's
+*initiating* workflow -- not `job_workflow_ref` (the reusable workflow actually executing a job,
+which can be nested arbitrarily deep via `uses:`, even cross-repo, without changing
+`workflow_ref`). Open VSX also allows exactly one trusted-publisher registration per extension,
+enforced server-side, not just a UI limitation.
+
+Because of this, `vscode-promote-prerelease.yml`, `vscode-promote-stable.yml`, and
+`vscode-manual-publish.yml` do **not** publish to Open VSX themselves, even when a caller asks
+for `ovsx`/`all` registries -- publishing from inside a `uses:`-nested reusable workflow would
+mint a different `workflow_ref` than whatever top-level workflow the caller already uses for its
+other release channels, and an extension can't have two trusted-publisher registrations.
+
+Instead, each caller designates **one** top-level workflow file per extension for Open VSX
+publishing, dispatched directly (e.g. via `gh workflow run`, never nested behind another `uses:`
+call) so every Open VSX publish for that extension shares the same `workflow_ref`. That file
+should delegate the actual publish step to [`openvsx-publish-release-vsix`](#openvsx-publish-release-vsix). The pattern:
+
+- `vscode-promote-prerelease.yml` takes the tag to promote as a `release-tag` input, so the
+  caller already has it and can dispatch its Open VSX workflow with the same value afterward.
+  `vscode-promote-stable.yml` creates the stable tag itself, so it exposes that tag back out
+  via a `release-tag` output instead.
+- `vscode-manual-publish.yml`'s `publish` job keeps its `ovsx` matrix leg as a deliberate no-op
+  (so job status and every downstream `needs.publish.result == 'success'` check are unaffected)
+  and expects the caller to dispatch its Open VSX workflow itself, for the `version-tag` source
+  path only -- `source-run-id` has no GitHub Release for a tag-based trusted-publishing dispatch
+  to target, so `prepare` hard-errors that combination (`registries: ovsx` or `all`) instead of
+  silently never publishing.
+
 ### Versioning Strategy
 
 These workflows use an **odd/even minor version convention** to distinguish release types: