diff --git a/.github/workflows/publish-nugets.yml b/.github/workflows/publish-nugets.yml
index 92fa097..fd6b9ac 100644
--- a/.github/workflows/publish-nugets.yml
+++ b/.github/workflows/publish-nugets.yml
@@ -6,6 +6,8 @@ on:
 jobs:
   publish:
     name: build, pack & publish
+    permissions:
+      id-token: write  # enable GitHub OIDC token issuance for this job
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v2
@@ -23,6 +25,11 @@ jobs:
         run: dotnet build --configuration Release --no-restore -p:Version=${{github.ref_name}}
       - name: Pack
         run: dotnet pack --configuration Release --no-build --no-restore -v normal -o ./nupkgs -p:Version=${{github.ref_name}}
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          user: ${{ secrets.NUGET_USER }}
       - name: Push
-        run: dotnet nuget push *.nupkg -k ${{secrets.NUGET_API_KEY}} -s https://api.nuget.org/v3/index.json --skip-duplicate -n true
-        working-directory: ./nupkgs
+        run: dotnet nuget push *.nupkg --api-key ${{steps.login.outputs.NUGET_API_KEY}} --source https://api.nuget.org/v3/index.json --skip-duplicate -n true
+        working-directory: ./nupkgs
\ No newline at end of file