diff --git a/.github/workflows/dotnet-build.yml b/.github/workflows/dotnet-build.yml
index c844b022d8..54511def35 100644
--- a/.github/workflows/dotnet-build.yml
+++ b/.github/workflows/dotnet-build.yml
@@ -382,6 +382,9 @@ jobs:
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
         needs: [ sign ]
         environment: nuget-release-gate # This gates this job until manually approved
+        permissions:
+            id-token: write
+            contents: read
         runs-on: ubuntu-latest
         
         steps:
@@ -397,10 +400,16 @@ jobs:
                     name: signed-packages
                     path: ./packages
 
+            -   name: NuGet login (OIDC)
+                id: login
+                uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1
+                with:
+                    user: ${{ secrets.NUGET_USER }}
+
             -   name: Push to NuGet.org
                 run: >
                     dotnet nuget push
                     **/*.nupkg
                     --source https://api.nuget.org/v3/index.json
-                    --api-key ${{ secrets.NUGET_PACKAGE_PUSH_TOKEN }}
+                    --api-key ${{ steps.login.outputs.NUGET_API_KEY }}
                     --skip-duplicate