diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 00d92bc..c76f975 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,6 +11,7 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -35,6 +36,18 @@ jobs:
           -p:Version=${{ steps.version.outputs.VERSION }}
           --output ./nupkg
 
+      - name: NuGet login (OIDC trusted publishing)
+        uses: NuGet/login@v1
+        id: nuget-login
+        with:
+          user: ${{ secrets.NUGET_USER }}
+
+      - name: Push to NuGet.org
+        run: >
+          dotnet nuget push ./nupkg/*.nupkg
+          --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
+          --source https://api.nuget.org/v3/index.json
+
       - name: Push to GitHub Packages
         run: >
           dotnet nuget push ./nupkg/*.nupkg
diff --git a/README.md b/README.md
index 9dd2043..4c5fbd4 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,7 @@ Dev-safe connections (localhost, 127.0.0.1, integrated security) are automatical
 Requires [.NET 10 SDK](https://dotnet.microsoft.com/download) or later.
 
 ```bash
-dotnet tool install --global SecretSecurity --add-source https://nuget.pkg.github.com/omegaleo/index.json
+dotnet tool install --global SecretSecurity
 ```
 
 ## Usage