diff --git a/.github/workflows/nuget-ci-cd.yml b/.github/workflows/nuget-ci-cd.yml
index ee26299..f713577 100644
--- a/.github/workflows/nuget-ci-cd.yml
+++ b/.github/workflows/nuget-ci-cd.yml
@@ -12,6 +12,7 @@ jobs:
   build:
     permissions:
       packages: write
+      id-token: write  # enable GitHub OIDC token issuance for NuGet trusted publishing
     runs-on: ubuntu-latest
 
     steps:
@@ -48,6 +49,13 @@ jobs:
           name: nuget-packages
           path: src/artifacts/package/release/*nupkg
 
+      - name: NuGet login
+        id: nuget-login
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
       - name: Publish package to NuGet.org
         if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
         shell: bash
@@ -83,4 +91,4 @@ jobs:
               --source https://api.nuget.org/v3/index.json
           done
         env:
-          NUGET_API_KEY: ${{ secrets.SILLSDEV_PUBLISH_NUGET_ORG }}
+          NUGET_API_KEY: ${{ steps.nuget-login.outputs.NUGET_API_KEY }}