diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8ca204e..0c15ed0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,6 +4,10 @@ on:
   push:
     branches:
       - master
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -11,14 +15,14 @@ jobs:
     steps:
     - name: checkout project
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: setup msbuild
       uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0
 
     - name: setup nuget
       uses: NuGet/setup-nuget@fd55a6f3b34392fa83fde1454582407d8c714123 # v4.0
-      env:
-        ACTIONS_ALLOW_UNSECURE_COMMANDS: 'true'
 
     - name: setup cppwinrt
       run: nuget restore test.sln
@@ -32,5 +36,35 @@ jobs:
     - name: nuget pack
       run: nuget.exe pack TestComponent/TestComponent.nuspec -OutputFileNamesWithoutVersion
 
+    - name: upload package
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      with:
+        name: testwinrt-package
+        path: KennyKerr.Windows.TestWinRT.nupkg
+        if-no-files-found: error
+        retention-days: 1
+
+  publish:
+    needs: build
+    if: github.event_name == 'workflow_dispatch' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+    runs-on: windows-latest
+    environment: nuget-publish
+    permissions: {}
+    steps:
+    - name: download package
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      with:
+        name: testwinrt-package
+        path: ${{ runner.temp }}\testwinrt-package
+
+    - name: setup nuget
+      uses: NuGet/setup-nuget@fd55a6f3b34392fa83fde1454582407d8c714123 # v4.0
+
     - name: nuget push
-      run: nuget push KennyKerr.Windows.TestWinRT.nupkg ${{ secrets.NUGET_KEY }} -Source nuget.org
+      env:
+        NUGET_KEY: ${{ secrets.NUGET_KEY }}
+      run: |
+        if ([string]::IsNullOrWhiteSpace($env:NUGET_KEY)) {
+          throw "Configure NUGET_KEY in the nuget-publish environment before publishing."
+        }
+        nuget push "${{ runner.temp }}\testwinrt-package\KennyKerr.Windows.TestWinRT.nupkg" -ApiKey $env:NUGET_KEY -Source https://api.nuget.org/v3/index.json