diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index e8e28cc647..b2ca6f4ac2 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -7,7 +7,7 @@ on:
     # allows triggering from the github UI
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   check_for_changes:
@@ -16,24 +16,37 @@ jobs:
       changed: ${{ steps.check.outputs.changed }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
+        with:
+          persist-credentials: false
       - name: Check if the current commit is less than 24 hours old
         id: check
         continue-on-error: true
-        run: test -n "$(git rev-list --after='24 hours' ${{ github.sha }})" && echo "changed=yes" >> "$GITHUB_OUTPUT"
+        env:
+          COMMIT_SHA: ${{ github.sha }}
+        run: test -n "$(git rev-list --after='24 hours' "${COMMIT_SHA}")" && echo "changed=yes" >> "$GITHUB_OUTPUT"
 
   publish:
     needs: check_for_changes
     if: needs.check_for_changes.outputs.changed == 'yes'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      WIF_PROVIDER: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github'
+      EXIT_GATE_AR_URL: 'https://us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/'
+      EXIT_GATE_MANIFEST_GCS: 'gs://oss-exit-gate-prod-projects-bucket/material-web/npm/manifests'
 
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: 18
           cache: npm
-      - uses: google/wireit@setup-github-actions-caching/v2
+      - uses: google/wireit@9d7c2e5346f8ef1b1ab6014c4e96c74e234f7ed5 # setup-github-actions-caching/v2
 
       - run: npm ci
       - run: npm run build
@@ -46,10 +59,50 @@ jobs:
           git config --local user.email "action@github.com"
           git config --local user.name "GitHub Action"
           git commit -am "chore: nightly publish"
-      - uses: actions/setup-node@v3
+
+      - name: Authenticate to Google Cloud
+        id: auth
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
-          node-version: 18
-          registry-url: 'https://wombat-dressing-room.appspot.com/'
-      - run: npm publish --tag nightly
+          token_format: 'access_token'
+          workload_identity_provider: ${{ env.WIF_PROVIDER }}
+
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3
+
+      - name: Stage package to OSS Exit Gate Artifact Registry
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
+          ACCESS_TOKEN: ${{ steps.auth.outputs.access_token }}
+        run: |
+          cat << 'NPMRC_EOF' > "$HOME/.npmrc"
+          registry=https://us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/
+          //us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/:always-auth=true
+          NPMRC_EOF
+          echo "//us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/:_authToken=${ACCESS_TOKEN}" >> "$HOME/.npmrc"
+          trap 'rm -f "$HOME/.npmrc"' EXIT
+          npm publish --tag nightly --registry="${EXIT_GATE_AR_URL}"
+
+      - name: Trigger OSS Exit Gate nightly release
+        env:
+          MANIFEST_NAME: manifest-${{ github.run_id }}-${{ github.run_attempt }}.json
+        run: |
+          VERSION="$(jq -r .version package.json)"
+          jq -n --arg ver "${VERSION}" '{
+            publish_all: false,
+            publishing_groups: [
+              {
+                packages: [
+                  {
+                    name: "@material/web",
+                    version: $ver
+                  }
+                ],
+                registry_config: {
+                  npm: {
+                    tags: ["nightly"]
+                  }
+                }
+              }
+            ]
+          }' > manifest.json
+          gcloud storage cp manifest.json "${EXIT_GATE_MANIFEST_GCS}/${MANIFEST_NAME}"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 318b78e2f3..3d4d3dbc1a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -11,24 +11,67 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      WIF_PROVIDER: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github'
+      EXIT_GATE_AR_URL: 'https://us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/'
+      EXIT_GATE_MANIFEST_GCS: 'gs://oss-exit-gate-prod-projects-bucket/material-web/npm/manifests'
 
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3
         with:
           node-version: 18
           cache: npm
-      - uses: google/wireit@setup-github-actions-caching/v2
+      - uses: google/wireit@9d7c2e5346f8ef1b1ab6014c4e96c74e234f7ed5 # setup-github-actions-caching/v2
 
       - run: npm ci
       - run: npm run build
         env:
           WIREIT_FAILURES: continue
 
-      - uses: actions/setup-node@v3
+      - name: Authenticate to Google Cloud
+        id: auth
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
-          node-version: 18
-          registry-url: 'https://wombat-dressing-room.appspot.com/'
-      - run: npm publish
+          token_format: 'access_token'
+          workload_identity_provider: ${{ env.WIF_PROVIDER }}
+
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3
+
+      - name: Stage package to OSS Exit Gate Artifact Registry
+        env:
+          ACCESS_TOKEN: ${{ steps.auth.outputs.access_token }}
+        run: |
+          cat << 'NPMRC_EOF' > "$HOME/.npmrc"
+          registry=https://us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/
+          //us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/:always-auth=true
+          NPMRC_EOF
+          echo "//us-npm.pkg.dev/oss-exit-gate-prod/material-web--npm/:_authToken=${ACCESS_TOKEN}" >> "$HOME/.npmrc"
+          trap 'rm -f "$HOME/.npmrc"' EXIT
+          npm publish --registry="${EXIT_GATE_AR_URL}"
+
+      - name: Trigger OSS Exit Gate release
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
+          MANIFEST_NAME: manifest-${{ github.run_id }}-${{ github.run_attempt }}.json
+        run: |
+          VERSION="$(jq -r .version package.json)"
+          jq -n --arg ver "${VERSION}" '{
+            publish_all: false,
+            publishing_groups: [
+              {
+                packages: [
+                  {
+                    name: "@material/web",
+                    version: $ver
+                  }
+                ]
+              }
+            ]
+          }' > manifest.json
+          gcloud storage cp manifest.json "${EXIT_GATE_MANIFEST_GCS}/${MANIFEST_NAME}"