diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5372a6ca..7734f8ef 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: release-please
     permissions:
-      id-token: write
+      id-token: write # enable GitHub OIDC token issuance for this job (NuGet login)
       contents: write # for SBOM release
       attestations: write # for actions/attest-sbom to create attestation
       packages: read # for internal nuget reading
@@ -62,8 +62,15 @@ jobs:
       - name: Pack
         run: dotnet pack -c Release --no-restore
 
+        # Get a short-lived NuGet API key
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@76cce0bd8d4b2f5dcdb45e2316d76c328632a902 # v1
+        id: login
+        with:
+          user: ${{secrets.NUGET_USER}}
+
       - name: Publish to Nuget
-        run: dotnet nuget push "src/**/*.nupkg" --api-key "${{ secrets.NUGET_TOKEN }}" --source https://api.nuget.org/v3/index.json
+        run: dotnet nuget push "src/**/*.nupkg" --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json
 
       - name: Generate artifact attestation
         uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0