diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 103ce09..e77f244 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -368,6 +368,7 @@ jobs:
     environment: release
     permissions:
       contents: read
+      id-token: write
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -388,15 +389,12 @@ jobs:
           chmod +x docker-agent
           sudo mv docker-agent /usr/local/bin/
 
-      - name: Docker Hub login
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         env:
-          HUB_ORG: ${{ secrets.HUB_ORG }}
-          HUB_OAT: ${{ secrets.HUB_OAT }}
-        run: |
-          set -e
-          if [ -z "${HUB_ORG}" ]; then echo "::error::HUB_ORG secret is not set"; exit 1; fi
-          if [ -z "${HUB_OAT}" ]; then echo "::error::HUB_OAT secret is not set"; exit 1; fi
-          echo "${HUB_OAT}" | docker login --username "${HUB_ORG}" --password-stdin
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+        with:
+          username: ${{ secrets.HUB_ORG }}
 
       - name: Push agent
         env: