diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 958a95ca..cf473ea2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,6 +111,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: [lint-and-approval-tests, unit-tests, integration-tests]
     if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
+    environment: release
+    permissions:
+      contents: read
+      id-token: write # required for NuGet trusted publishing (OIDC)
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -126,5 +130,10 @@ jobs:
         run: dotnet build ${{ github.workspace }}/Source/EasyNetQ.Management.Client.slnx --configuration Release
       - name: Pack
         run: dotnet pack ${{ github.workspace }}/Source/EasyNetQ.Management.Client.slnx --configuration Release --no-build --include-symbols -p:PackageOutputPath="${{ github.workspace }}/Packages"
+      - name: NuGet login
+        uses: NuGet/login@v1
+        id: nuget-login
+        with:
+          user: EasyNetQ
       - name: Publish
-        run: dotnet nuget push '${{ github.workspace }}/Packages/*.*' --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_TOKEN }}
+        run: dotnet nuget push '${{ github.workspace }}/Packages/*.*' --source https://api.nuget.org/v3/index.json --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }}