diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c30f8da..8b69155 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -353,6 +353,10 @@ jobs:
     name: publish-crates
     needs: ["create-release", "build-release", "build-release-deb"]
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -385,10 +389,15 @@ jobs:
             exit 1
           fi
 
+      - name: Authenticate to crates.io via trusted publishing
+        if: steps.crates_check.outputs.already_published != 'true'
+        id: crates_auth
+        uses: rust-lang/crates-io-auth-action@v1
+
       - name: Publish to crates.io
         if: steps.crates_check.outputs.already_published != 'true'
         env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.crates_auth.outputs.token }}
         shell: bash
         run: |
           set -euo pipefail
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a51b40d..48e4ed2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 ## Fixed
 - Cargo publish pipeline now succeeds on crates.io category validation:
   - replaced unsupported category slug `datascience` with `science` in `Cargo.toml`.
+- Cargo publish workflow now uses crates.io Trusted Publishing (OIDC) in `release.yml`.
 - Release reruns for the same tag are now safe:
   - `gh release upload` now uses clobber mode in both archive upload jobs.
 - `publish-crates` crates.io API checks now include required request headers to avoid 403 responses.