diff --git a/.github/workflows/crates-io.yml b/.github/workflows/crates-io.yml
index c6d2547..709d997 100644
--- a/.github/workflows/crates-io.yml
+++ b/.github/workflows/crates-io.yml
@@ -7,36 +7,37 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+
+      - name: Authenticate with crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4
 
       - name: Publish crates to crates.io
         env:
-          TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
         shell: bash
         run: |
-          if [ -z "${TOKEN:-}" ]; then
-            echo "skipping (no CARGO_REGISTRY_TOKEN)"
-            exit 0
-          fi
-          cargo publish -p tare-tokenize --no-verify --token "$TOKEN"
+          cargo publish -p tare-tokenize --no-verify
           sleep 20
-          cargo publish -p tare-cache --no-verify --token "$TOKEN"
+          cargo publish -p tare-cache --no-verify
           sleep 20
-          cargo publish -p tare-core --no-verify --token "$TOKEN"
+          cargo publish -p tare-core --no-verify
           sleep 20
-          cargo publish -p tare-memory --no-verify --token "$TOKEN"
+          cargo publish -p tare-memory --no-verify
           sleep 20
-          cargo publish -p tare-cli --no-verify --token "$TOKEN"
+          cargo publish -p tare-cli --no-verify
           sleep 20
-          cargo publish -p tare-proxy --no-verify --token "$TOKEN"
+          cargo publish -p tare-proxy --no-verify
           sleep 20
-          cargo publish -p tare-mcp --no-verify --token "$TOKEN"
+          cargo publish -p tare-mcp --no-verify