@@ -1535,122 +1535,155 @@ t.test('oidc token exchange - provenance', (t) => {
     },
   }))
 
-  t.test('provenance-file config should take precedence over OIDC auto-provenance', async t => {
-    const bundleDir = t.testdir()
-    const provenanceBundlePath = path.join(bundleDir, 'provenance-bundle.json')
-    // holder so the libnpmpack mock can return the tarball computed below
-    const packMock = { tarballData: null }
+  const provenanceFileSources = [
+    {
+      name: 'CLI config',
+      options: provenanceBundlePath => ({
+        config: {
+          'provenance-file': provenanceBundlePath,
+        },
+      }),
+    },
+    {
+      // exercises Publish.#getManifest() and its flatten(filteredPublishConfig, opts)
+      // path: publishConfig must reach opts.provenanceFile before oidc() decides
+      // whether to enable automatic provenance
+      name: 'publishConfig',
+      options: provenanceBundlePath => ({
+        packageJson: {
+          publishConfig: {
+            'provenance-file': provenanceBundlePath,
+          },
+        },
+      }),
+    },
+  ]
 
-    const { npm, registry, prefix, joinedOutput } = await mockOidc(t, {
-      oidcOptions: { github: true },
-      config: {
-        '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
-        'provenance-file': provenanceBundlePath,
-      },
-      mockGithubOidcOptions: {
-        audience: 'npm:registry.npmjs.org',
-        idToken: githubPublicIdToken,
-      },
-      mockOidcTokenExchangeOptions: {
-        idToken: githubPublicIdToken,
-        body: {
-          token: 'exchange-token',
+  for (const { name, options } of provenanceFileSources) {
+    t.test(`${name} provenance-file takes precedence over OIDC auto-provenance`, async t => {
+      const bundleDir = t.testdir()
+      const provenanceBundlePath = path.join(
+        bundleDir,
+        'provenance-bundle.json'
+      )
+      // holder so the libnpmpack mock can return the tarball computed below
+      const packMock = { tarballData: null }
+
+      const sourceOptions = options(provenanceBundlePath)
+
+      const { npm, registry, prefix, joinedOutput } = await mockOidc(t, {
+        oidcOptions: { github: true },
+        config: {
+          '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+          ...sourceOptions.config,
         },
-      },
-      publishOptions: {
-        token: 'exchange-token',
-        noPut: true,
-      },
-      load: {
-        mocks: {
-          // the registry visibility check passes for this public package so the
-          // OIDC flow would auto-enable provenance unless provenance-file wins
-          libnpmaccess: {
-            getVisibility: async () => ({ public: true }),
+        packageJson: sourceOptions.packageJson,
+        mockGithubOidcOptions: {
+          audience: 'npm:registry.npmjs.org',
+          idToken: githubPublicIdToken,
+        },
+        mockOidcTokenExchangeOptions: {
+          idToken: githubPublicIdToken,
+          body: {
+            token: 'exchange-token',
           },
-          // publish a deterministic tarball so the bundle subject digest can match it
-          libnpmpack: async () => packMock.tarballData,
-          // libnpmpublish must be mocked as a module so its internal require of
-          // sigstore is intercepted: a user-supplied bundle is only verified,
-          // generation (attest) must never run
-          libnpmpublish: t.mock('libnpmpublish', {
-            'libnpmpublish/lib/provenance': t.mock('libnpmpublish/lib/provenance', {
-              sigstore: {
-                verify: async () => {},
-                attest: async () => {
-                  throw new Error('sigstore.attest must not be called when provenance-file is configured')
+        },
+        publishOptions: {
+          token: 'exchange-token',
+          noPut: true,
+        },
+        load: {
+          mocks: {
+            libnpmaccess: {
+              getVisibility: async () => ({ public: true }),
+            },
+            // publish a deterministic tarball so the bundle subject digest can match it
+            libnpmpack: async () => packMock.tarballData,
+            // libnpmpublish must be mocked as a module so its internal require of
+            // sigstore is intercepted: a user-supplied bundle is only verified,
+            // generation (attest) must never run
+            libnpmpublish: t.mock('libnpmpublish', {
+              'libnpmpublish/lib/provenance': t.mock('libnpmpublish/lib/provenance', {
+                sigstore: {
+                  verify: async () => {},
+                  attest: async () => {
+                    throw new Error('sigstore.attest must not be called when provenance-file is configured')
+                  },
                 },
-              },
+              }),
             }),
-          }),
+          },
         },
-      },
-    })
+      })
 
-    // compute the tarball integrity the same way libnpmpublish does so the
-    // provenance bundle subject matches the packed tarball
-    packMock.tarballData = await pacote.tarball(prefix, { Arborist })
-    const integrity = ssri.fromData(packMock.tarballData, { algorithms: ['sha512'] })
-    const spec = npa.resolve(pkg, '1.0.0')
-    const provenanceBundle = {
-      mediaType: 'application/vnd.dev.sigstore.bundle+json;version=0.2',
-      verificationMaterial: {
-        x509CertificateChain: {
-          certificates: [{ rawBytes: 'dGVzdA==' }],
+      // compute the tarball integrity the same way libnpmpublish does so the
+      // provenance bundle subject matches the packed tarball
+      packMock.tarballData = await pacote.tarball(prefix, { Arborist })
+      const integrity = ssri.fromData(packMock.tarballData, { algorithms: ['sha512'] })
+      const spec = npa.resolve(pkg, '1.0.0')
+      const provenanceBundle = {
+        mediaType: 'application/vnd.dev.sigstore.bundle+json;version=0.2',
+        verificationMaterial: {
+          x509CertificateChain: {
+            certificates: [{ rawBytes: 'dGVzdA==' }],
+          },
+          tlogEntries: [],
         },
-        tlogEntries: [],
-      },
-      dsseEnvelope: {
-        payload: Buffer.from(JSON.stringify({
-          _type: 'https://in-toto.io/Statement/v0.1',
-          subject: [
-            {
-              name: npa.toPurl(spec),
-              digest: { sha512: integrity.sha512[0].hexDigest() },
-            },
-          ],
-          predicateType: 'https://slsa.dev/provenance/v0.2',
-          predicate: {},
-        })).toString('base64'),
-        payloadType: 'application/vnd.in-toto+json',
-        signatures: [{
-          /* eslint-disable-next-line max-len */
-          sig: 'MEUCIQDqHtpkk1d0rMGLmf3qet9jLale3KVn8Pnywpwt7ln+9AIgG9CJvvUmyemhNYHz0DfJ4vMfKk1TMg+m3hR0mISXJos=',
-          keyid: '',
-        }],
-      },
-    }
-    fs.writeFileSync(provenanceBundlePath, JSON.stringify(provenanceBundle, null, 2))
+        dsseEnvelope: {
+          payload: Buffer.from(JSON.stringify({
+            _type: 'https://in-toto.io/Statement/v0.1',
+            subject: [
+              {
+                name: npa.toPurl(spec),
+                digest: { sha512: integrity.sha512[0].hexDigest() },
+              },
+            ],
+            predicateType: 'https://slsa.dev/provenance/v0.2',
+            predicate: {},
+          })).toString('base64'),
+          payloadType: 'application/vnd.in-toto+json',
+          signatures: [{
+            /* eslint-disable-next-line max-len */
+            sig: 'MEUCIQDqHtpkk1d0rMGLmf3qet9jLale3KVn8Pnywpwt7ln+9AIgG9CJvvUmyemhNYHz0DfJ4vMfKk1TMg+m3hR0mISXJos=',
+            keyid: '',
+          }],
+        },
+      }
+      fs.writeFileSync(provenanceBundlePath, JSON.stringify(provenanceBundle, null, 2))
+
+      let publishedBody
+      registry.nock
+        .put(`/${spec.escapedName}`, (body) => {
+          publishedBody = body
+          return true
+        })
+        .matchHeader('authorization', 'Bearer exchange-token')
+        // optional so a failed publish does not leave a pending mock behind
+        .optionally()
+        .reply(200, {})
+
+      // libnpmpublish checks package visibility itself before generating
+      // provenance; optional so it is only consumed if generation is attempted
+      registry.nock
+        .get(`/-/package/${spec.escapedName}/visibility`)
+        .optionally()
+        .reply(200, { public: true })
 
-    let publishedBody
-    registry.nock
-      .put(`/${spec.escapedName}`, (body) => {
-        publishedBody = body
-        return true
-      })
-      .matchHeader('authorization', 'Bearer exchange-token')
-      // optional so a failed publish does not leave a pending mock behind
-      .optionally()
-      .reply(200, {})
-
-    // libnpmpublish checks package visibility itself before generating
-    // provenance; optional so it is only consumed if generation is attempted
-    registry.nock
-      .get(`/-/package/${spec.escapedName}/visibility`)
-      .optionally()
-      .reply(200, { public: true })
+      await npm.exec('publish', [])
 
-    await npm.exec('publish', [])
+      t.match(joinedOutput(), '+ @npmcli/test-package@1.0.0')
 
-    t.match(joinedOutput(), '+ @npmcli/test-package@1.0.0')
-    const sigstoreAttachment = publishedBody?._attachments[`${pkg}-1.0.0.sigstore`]
-    t.ok(sigstoreAttachment, 'published packument includes a sigstore bundle attachment')
-    t.strictSame(
-      JSON.parse(sigstoreAttachment.data),
-      provenanceBundle,
-      'published sigstore bundle is the user-supplied provenance file'
-    )
-  })
+      const attachment =
+        publishedBody?._attachments[`${pkg}-1.0.0.sigstore`]
+
+      t.ok(attachment, 'published packument includes supplied provenance')
+      t.strictSame(
+        JSON.parse(attachment.data),
+        provenanceBundle,
+        'published sigstore bundle is the user-supplied provenance file'
+      )
+    })
+  }
 
   const brokenJwts = [
     'x.invalid-jwt.x',