diff --git a/.github/workflows/release-crates.yml b/.github/workflows/release-crates.yml
index 8e5016e0..4db326af 100644
--- a/.github/workflows/release-crates.yml
+++ b/.github/workflows/release-crates.yml
@@ -14,9 +14,8 @@ jobs:
   # Create a PR with the new versions and changelog, preparing the next release.
   open-pr:
     name: Open release PR
-    runs-on: ubuntu-latest
     environment: cratesio-publish
-
+    runs-on: ubuntu-latest
     concurrency:
       group: release-plz-${{ github.ref }}
       cancel-in-progress: false
@@ -39,8 +38,10 @@ jobs:
   # Release unpublished packages.
   release:
     name: Release crates
-    runs-on: ubuntu-latest
     environment: cratesio-publish
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
 
     steps:
       - name: Checkout repository
@@ -48,8 +49,12 @@ jobs:
         with:
           fetch-depth: 512
 
+      - name: Authenticate with crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@v1
+
       - name: Run release-plz
         uses: Devolutions/actions-public/release-plz@v1
         with:
           command: release
-          registry-token: ${{ secrets.CRATES_IO_TOKEN }}
+          registry-token: ${{ steps.auth.outputs.token }}