diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52b4420..2f57b90 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -435,6 +435,9 @@ jobs:
 
       - name: Build
         run: cargo build --release --verbose
+      - name: Authenticate with crates.io
+        id: crates-io-auth
+        uses: rust-lang/crates-io-auth-action@v1
       - name: Publish Crate
         working-directory: ./toolproof
         run: |
@@ -444,4 +447,4 @@ jobs:
             cargo publish --allow-dirty
           fi
         env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 888e1a8..2b8587f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,8 @@
 
 ## Unreleased
 
+* No changes (CI release improvements)
+
 ## v0.17.1 (April 1, 2026)
 
 * Fixed binary permissions when executing toolproof through npm