diff --git a/CHANGELOG.md b/CHANGELOG.md
index af368c1..528fe28 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 2.15.0
+
+* Allow `pkg.npmToken` to be null. This causes npm deployment to use the system
+  token if one is available, which is necessary for using [trusted publishing].
+
+[trusted publishing]: https://docs.npmjs.com/trusted-publishers
+
 ## 2.14.0
 
 * Add a `pkg.useExe` config variable to allow users to customize exactly when
diff --git a/lib/src/npm.dart b/lib/src/npm.dart
index 67b49cb..139cad6 100644
--- a/lib/src/npm.dart
+++ b/lib/src/npm.dart
@@ -224,11 +224,13 @@ final npmReadme = InternalConfigVariable.fn<String?>(
 /// **Do not check this in directly.** This should only come from secure
 /// sources.
 ///
-/// By default this comes from the `NPM_TOKEN` environment variable.
-final npmToken = InternalConfigVariable.fn<String>(
-  () =>
-      Platform.environment["NPM_TOKEN"] ??
-      fail("pkg.npmToken must be set to deploy to npm."),
+/// By default this comes from the `NPM_TOKEN` environment variable. If it's not
+/// set, npm will use whatever tokens the system has available; this is
+/// necessary for using [trusted publishing].
+///
+/// [trusted publishing]: https://docs.npmjs.com/trusted-publishers
+final npmToken = InternalConfigVariable.fn<String?>(
+  () => Platform.environment["NPM_TOKEN"],
 );
 
 /// The [distribution tag][] to use when publishing the current `npm` package.
@@ -807,9 +809,13 @@ const _cliPkgExports = {};
 
 /// Publishes the contents of `build/npm` to npm.
 Future<void> _deploy() async {
-  var file = File(".npmrc").openSync(mode: FileMode.writeOnlyAppend);
-  file.writeStringSync("\n//registry.npmjs.org/:_authToken=$npmToken");
-  file.closeSync();
+  if (npmToken.value case var token?) {
+    var file = File(".npmrc").openSync(mode: FileMode.writeOnlyAppend);
+    file.writeStringSync("\n//registry.npmjs.org/:_authToken=$token");
+    file.closeSync();
+  } else {
+    log("npmToken not set, using system credentials");
+  }
 
   // The trailing slash in "build/npm/" is necessary to avoid NPM trying to
   // treat the path name as a GitHub repository slug.
diff --git a/pubspec.yaml b/pubspec.yaml
index 60a0b4f..450d2e7 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -1,5 +1,5 @@
 name: cli_pkg
-version: 2.14.0
+version: 2.15.0
 description: Grinder tasks for releasing Dart CLI packages.
 homepage: https://github.com/google/dart_cli_pkg