diff --git a/.github/workflows/publish-rc.yaml b/.github/workflows/publish-rc.yaml
index f2e23fe3c..808ca0588 100644
--- a/.github/workflows/publish-rc.yaml
+++ b/.github/workflows/publish-rc.yaml
@@ -60,10 +60,17 @@ jobs:
             exit 1
           fi
 
+      - name: Authenticate with Cloudsmith via OIDC
+        uses: cloudsmith-io/cloudsmith-cli-action@v2
+        with:
+          oidc-namespace: 'gusto'
+          oidc-service-slug: 'gusto-cloudsmith-write-svc-01'
+          oidc-auth-only: 'true'
+
       - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
+          registry-url: 'https://cloudsmith.io/gusto/gusto'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -169,7 +176,7 @@ jobs:
       - name: Publish RC version
         run: npm publish --access public --tag rc
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ env.CLOUDSMITH_API_KEY }}
 
       - name: Output published version
         run: |
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 63d08d754..2d4c1986d 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -21,10 +21,17 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
+      - name: Authenticate with Cloudsmith via OIDC
+        uses: cloudsmith-io/cloudsmith-cli-action@v2
+        with:
+          oidc-namespace: 'gusto'
+          oidc-service-slug: 'gusto-cloudsmith-write-svc-01'
+          oidc-auth-only: 'true'
+
       - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
+          registry-url: 'https://cloudsmith.io/gusto/gusto'
 
       - name: Restore node_modules cache
         id: cache-node-modules
@@ -81,7 +88,7 @@ jobs:
       - name: Publish to NPM
         run: npm publish --access public
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ env.CLOUDSMITH_API_KEY }}
 
       - name: Read SDK version
         id: version
diff --git a/.github/workflows/unpublish-rc.yaml b/.github/workflows/unpublish-rc.yaml
index 8a71dc71b..4cbaf2581 100644
--- a/.github/workflows/unpublish-rc.yaml
+++ b/.github/workflows/unpublish-rc.yaml
@@ -31,10 +31,16 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v6
+      - name: Authenticate with Cloudsmith via OIDC
+        uses: cloudsmith-io/cloudsmith-cli-action@v2
+        with:
+          oidc-namespace: 'gusto'
+          oidc-service-slug: 'gusto-cloudsmith-write-svc-01'
+          oidc-auth-only: 'true'
       - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
+          registry-url: 'https://cloudsmith.io/gusto/gusto'
 
       - name: Validate confirmation
         run: |
@@ -176,7 +182,7 @@ jobs:
             fi
           fi
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ env.CLOUDSMITH_API_KEY }}
 
       - name: Summary
         run: |
diff --git a/.github/workflows/unpublish.yaml b/.github/workflows/unpublish.yaml
index 1c640eaf5..49cb5f795 100644
--- a/.github/workflows/unpublish.yaml
+++ b/.github/workflows/unpublish.yaml
@@ -13,10 +13,16 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v6
+      - name: Authenticate with Cloudsmith via OIDC
+        uses: cloudsmith-io/cloudsmith-cli-action@v2
+        with:
+          oidc-namespace: 'gusto'
+          oidc-service-slug: 'gusto-cloudsmith-write-svc-01'
+          oidc-auth-only: 'true'
       - uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
+          registry-url: 'https://cloudsmith.io/gusto/gusto'
       - run: npm unpublish @gusto/embedded-react-sdk@${{ github.event.inputs.version }}
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ env.CLOUDSMITH_API_KEY }}