diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index 4628c0aa..169022ee 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -328,12 +328,14 @@ jobs:
           API_KEY: ${{ secrets.FEEDZ_API_KEY }}
         run: |
           if [ -z "$API_KEY" ]; then
-            echo "::error::API key for feedz.io is empty. Check the secret or the NuGet login (OIDC) step output that feeds it; nothing was pushed."
+            echo "::error::API key for feedz.io is empty. Check the FEEDZ_API_KEY repository secret; nothing was pushed."
             exit 1
           fi
 
       - name: Publish to feedz.io
-        run: dotnet nuget push ./elsa-studio-nuget-packages/*.nupkg -k ${{ secrets.FEEDZ_API_KEY }} -s ${{ env.nuget_feed_feedzio }} --skip-duplicate
+        env:
+          API_KEY: ${{ secrets.FEEDZ_API_KEY }}
+        run: dotnet nuget push ./elsa-studio-nuget-packages/*.nupkg -k "$API_KEY" -s ${{ env.nuget_feed_feedzio }} --skip-duplicate
 
   publish_nuget_nuget:
     name: Publish to nuget.org
@@ -367,9 +369,11 @@ jobs:
           API_KEY: ${{ steps.nuget_login.outputs.NUGET_API_KEY }}
         run: |
           if [ -z "$API_KEY" ]; then
-            echo "::error::API key for nuget.org is empty. Check the secret or the NuGet login (OIDC) step output that feeds it; nothing was pushed."
+            echo "::error::API key for nuget.org is empty. Check the NuGet login (OIDC) step output and the Trusted Publishing policy on nuget.org; nothing was pushed."
             exit 1
           fi
 
       - name: Publish to nuget.org
-        run: dotnet nuget push ./elsa-studio-nuget-packages/*.nupkg --api-key ${{ steps.nuget_login.outputs.NUGET_API_KEY }} --source ${{ env.nuget_feed_nuget }} --skip-duplicate
+        env:
+          API_KEY: ${{ steps.nuget_login.outputs.NUGET_API_KEY }}
+        run: dotnet nuget push ./elsa-studio-nuget-packages/*.nupkg --api-key "$API_KEY" --source ${{ env.nuget_feed_nuget }} --skip-duplicate