diff --git a/.github/workflows/dotnet_tool_deploy.yml b/.github/workflows/dotnet_tool_deploy.yml
index 83a6a0b2..83a65f5d 100644
--- a/.github/workflows/dotnet_tool_deploy.yml
+++ b/.github/workflows/dotnet_tool_deploy.yml
@@ -38,5 +38,12 @@ jobs:
           dotnet tool restore
           dotnet cake --target Pack-DotNetTool --package-version ${{ steps.version.outputs.version }}
 
+      - name: NuGet login (OIDC → temp API key)
+        uses: NuGet/login@v1
+        id: login
+        with:
+          # Secret is your NuGet username
+          user: ${{ secrets.NUGET_USER }}
+
       - name: Publish to NuGet
-        run: dotnet nuget push ./artifacts/nupkgs/*.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_API_KEY }}
+        run: dotnet nuget push ./artifacts/nupkgs/*.nupkg --source https://api.nuget.org/v3/index.json --api-key "${{ steps.login.outputs.NUGET_API_KEY }}"