The change is small on paper and large in practice. Granular access tokens with `bypass2fa=true` — the kind CI pipelines lean on so a publish doesn't stall waiting for a human — start losing their account-management reach in early August. They can no longer create or revoke other tokens, change a password, email, or 2FA setup, add and remove package maintainers, or touch org and team membership. Those operations now demand an interactive 2FA prompt, full stop. Direct publishing survives for now, but not for long: around January 2027 the bypass tokens lose that too, dropping to reading private packages and staging a publish that only goes public once someone approves it with 2FA. If you run releases through CI, the migration GitHub is steering everyone toward is OIDC trusted publishing — short-lived, per-workflow credentials instead of one long-lived token that can do everything. Worth wiring up before a release quietly fails.