diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 714d6b0..4e4e6fb 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -12,7 +12,23 @@ on:
 
 jobs:
   publish:
-    uses: peacefulstudio/github-actions/.github/workflows/csharp-publish-public.yaml@v1
-    secrets: inherit
-    with:
-      version_override: ${{ inputs.version_override }}
+    runs-on: ubuntu-latest
+    environment: nuget-publish
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+      - name: NuGet login (OIDC -> short-lived key)
+        id: login
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+        with:
+          user: ${{ secrets.NUGET_USER }}
+      - name: Build, test, pack & push
+        uses: peacefulstudio/github-actions/.github/actions/csharp-publish@v1
+        with:
+          api-key: ${{ steps.login.outputs.NUGET_API_KEY }}
+          version_override: ${{ inputs.version_override }}