diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5dc13ea0..e2491404 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -105,7 +105,7 @@ jobs:
     needs: [create_nuget, build_and_test]
     permissions:
       contents: read
-      packages: write
+      id-token: write
     steps:
       - uses: actions/download-artifact@v8
         with:
@@ -115,6 +115,16 @@ jobs:
         uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "10.0.x"
+      # If this is a tag build, log in to NuGet using OIDC. For this to work,
+      # - One of the ubisoft-square organization (https://www.nuget.org/profiles/ubisoft-square) admin user accounts
+      #   was used to set up a Trusted Publishing (https://www.nuget.org/account/trustedpublishing)
+      # - NUGET_USER was set as an Actions repository secret (https://github.com/ubisoft/NGitLab/settings/secrets/actions) to that admin's username
+      - name: NuGet login (OIDC)
+        id: nuget-login
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: NuGet/login@v1
+        with:
+          user: ${{secrets.NUGET_USER}}
       - name: Publish NuGet packages
         run: |
           Write-Host "Current ref: $env:GITHUB_REF"
@@ -124,7 +134,7 @@ jobs:
               if ($env:GITHUB_REF -clike 'refs/tags/*')
               {
                 Write-Host "Pushing NuGet package: $($file.FullName)"
-                & dotnet nuget push "$($file.FullName)" --api-key "${{secrets.NUGET_APIKEY}}" --source https://api.nuget.org/v3/index.json --force-english-output --skip-duplicate
+                & dotnet nuget push "$($file.FullName)" --api-key "${{steps.nuget-login.outputs.NUGET_API_KEY}}" --source https://api.nuget.org/v3/index.json --force-english-output --skip-duplicate
               }
               else
               {