diff --git a/.github/workflows/wasm-release.yml b/.github/workflows/wasm-release.yml
index 9bed832a0..4ecba437e 100644
--- a/.github/workflows/wasm-release.yml
+++ b/.github/workflows/wasm-release.yml
@@ -2,6 +2,11 @@ name: WebAssembly Publish
 
 on:
   workflow_dispatch:
+    inputs:
+      npm_otp:
+        description: "One-time password for npm publish (optional)"
+        required: false
+        type: string
   release:
     types: [published]
 
@@ -61,7 +66,12 @@ jobs:
       - name: Test
         run: npm test
 
+      - name: Mask npm OTP
+        if: ${{ github.event.inputs.npm_otp != '' }}
+        run: echo "::add-mask::${{ github.event.inputs.npm_otp }}"
+
       - name: Publish
         run: npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_OTP: ${{ github.event.inputs.npm_otp }}