diff --git a/.github/workflows/nuget-release.yml b/.github/workflows/nuget-release.yml
index d3a0a820..97761056 100644
--- a/.github/workflows/nuget-release.yml
+++ b/.github/workflows/nuget-release.yml
@@ -12,6 +12,8 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # enable GitHub OIDC token issuance for Trusted Publishing
     steps:
     - name: Checkout code
       uses: actions/checkout@v6
@@ -58,9 +60,15 @@ jobs:
     - name: List generated packages
       run: find artifacts/package/release -name "*.nupkg" -type f
 
+    - name: NuGet login (OIDC -> short-lived API key)
+      uses: NuGet/login@v1
+      id: login
+      with:
+        user: ${{ secrets.NUGET_USER }}
+
     - name: Publish to NuGet
       run: |
         for package in artifacts/package/release/*.nupkg; do
           echo "Publishing $package"
-          dotnet nuget push "$package" --api-key ${{ secrets.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate
+          dotnet nuget push "$package" --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate
         done