diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ad1db4f..b0e4a7d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,6 +34,9 @@ jobs:
     name: 🚀 Release
     if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     env:
       DOTNET_VERSION: "9.0.x"
     steps:
@@ -177,14 +180,21 @@ jobs:
           dotnet pack src/stream-feed-net.csproj --configuration Release --no-build --output ./packages
           ls -la ./packages/
 
+      - name: NuGet login (OIDC)
+        if: steps.release_meta_final.outputs.should_release == 'true'
+        uses: NuGet/login@v1
+        id: nuget_login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
       - name: Publish to NuGet
         if: steps.release_meta_final.outputs.should_release == 'true'
         env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+          NUGET_API_KEY: ${{ steps.nuget_login.outputs.NUGET_API_KEY }}
         run: |
           if [ -z "$NUGET_API_KEY" ]; then
-            echo "NUGET_API_KEY secret not set. Skipping NuGet publish."
-            exit 0
+            echo "NuGet/login did not return NUGET_API_KEY. Check Trusted Publishing policy and secrets.NUGET_USER (nuget.org profile name, not email)."
+            exit 1
           fi
 
           dotnet nuget remove source nuget.org || true