diff --git a/.github/workflows/maven-central-deploy.yml b/.github/workflows/maven-central-deploy.yml
index 731d745..c4bcf2a 100644
--- a/.github/workflows/maven-central-deploy.yml
+++ b/.github/workflows/maven-central-deploy.yml
@@ -55,6 +55,16 @@ jobs:
         servers: '[{"id": "central", "username": "${env.MAVEN_CENTRAL_USERNAME}", "password": "${env.MAVEN_CENTRAL_TOKEN}"}]'
         sonatypeSnapshots: true
 
+    - name: Declare Central as an origin of server central
+      # Maven 3.10 only sends the credentials of a server to the origins declared for its id, and the id "central"
+      # is bound to repo.maven.apache.org by the built-in central repository. Add https://central.sonatype.com to the
+      # origins of server central, so the publishing token reaches Central but not a repository named "central" at
+      # any other origin (unlike -Dmaven.repository.credentialScope=id). Maven 3.9 ignores the element (with a warning).
+      shell: bash
+      run: |
+        perl -0pi -e 's#(<server>\s*<id>central</id>)#$1\n    <repositoryOrigins>\n        <repositoryOrigin>https://central.sonatype.com</repositoryOrigin>\n    </repositoryOrigins>#' ~/.m2/settings.xml
+        grep -q '<repositoryOrigin>https://central.sonatype.com</repositoryOrigin>' ~/.m2/settings.xml
+
     - name: Setup Node.js ${{ inputs.nodeVersion }}
       uses: actions/setup-node@v6
       with: