diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 97fe903..45aeb9d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,16 +32,26 @@ jobs:
 
   docker:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
       - uses: docker/setup-buildx-action@v1
       - uses: docker/setup-qemu-action@v1
-      - uses: docker/login-action@v1
+      - name: OIDC token
+        id: docker_oidc
+        uses: docker/oidc-action@96ba694c64860c7209bcd1ede7d698c71564ef78 # v1.2.0
         with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+          connection-id: "24b78b4d-ffde-4850-a999-76d7bbaf3214"
+          expires-in: 1800
+      - name: Docker login
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: kentik
+          password: ${{ steps.docker_oidc.outputs.token }}
       - uses: actions/download-artifact@v2
         with:
           name: convis-aarch64-unknown-linux-musl