diff --git a/.github/workflows/publish_nuget.yml b/.github/workflows/publish_nuget.yml
index 0435d04..d1899a5 100644
--- a/.github/workflows/publish_nuget.yml
+++ b/.github/workflows/publish_nuget.yml
@@ -42,10 +42,16 @@ jobs:
     - name: Create Packages
       run:  dotnet pack /p:PackageVersion=${{ github.ref_name }} -c Release -o ./output
 
+    - name: NuGet login (OIDC → temp API key)
+      uses: NuGet/login@v1
+      id: nuget-login
+      with:
+        user: ${{ secrets.NUGET_USER }}
+
     - name: Push Packages
       run: |
-        dotnet nuget push "output/*.nupkg" -s https://api.nuget.org/v3/index.json
-        dotnet nuget push "output/*.snupkg" -s https://api.nuget.org/v3/index.json
+        dotnet nuget push "output/*.nupkg" --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
+        dotnet nuget push "output/*.snupkg" --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json
 
     - name: "Extract latest release notes"
       shell: pwsh