diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 99b54e7..7984820 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,8 +2,8 @@ name: CI
 on:
   push:
     tags:
-      - '[0-9].[0-9]+.[0-9]'
-      - '[0-9].[0-9]+.[0-9]+-*'
+      - '[0-9]+.[0-9]+.[0-9]+'
+      - '[0-9]+.[0-9]+.[0-9]+-*'
     branches:
       - master
       - release-*
@@ -49,6 +49,9 @@ jobs:
   release:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: checkout code
         uses: actions/checkout@v6.0.2
@@ -65,7 +68,7 @@ jobs:
         id: check-tag-type
         if: github.ref_type == 'tag'
         run: |
-          if [[ ${{ github.ref_name }} =~ [0-9]+.[0-9]+.[0-9]+$ ]]; then
+          if [[ ${{ github.ref_name }} =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "release-type=production" >> $GITHUB_OUTPUT
           else
             echo "release-type=pre-release" >> $GITHUB_OUTPUT
@@ -76,9 +79,15 @@ jobs:
           echo "Tag is pre-release"
           echo "Pushing package to Feedz.io"
           dotnet nuget push ./nugets/*.nupkg --source https://f.feedz.io/servicecomposer/pre-releases/nuget --api-key ${{ secrets.FEEDZ_API_KEY }}
+      - name: NuGet login
+        id: nuget-login
+        if: steps.check-tag-type.outputs.release-type == 'production'
+        uses: NuGet/login@v1.2.0
+        with:
+          user: ${{ secrets.NUGET_USER }}
       - name: Deploy release to NuGet
         if: steps.check-tag-type.outputs.release-type == 'production'
         run: |
           echo "Tag is production"
           echo "Pushing package to NuGet.org"
-          dotnet nuget push ./nugets/*.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ secrets.NUGET_API_KEY }}
+          dotnet nuget push ./nugets/*.nupkg --source https://api.nuget.org/v3/index.json --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }}