diff --git a/.github/workflows/push-sandbox-image.yml b/.github/workflows/push-sandbox-image.yml
index 1a5e3e72c..b1ec562d0 100644
--- a/.github/workflows/push-sandbox-image.yml
+++ b/.github/workflows/push-sandbox-image.yml
@@ -23,6 +23,7 @@ jobs:
       id-token: write
       contents: read
     with:
+      artifactory_oidc_provider_name: github-jfrog-trueforge
       artifactory_registry_url: ${{ vars.TRUEFOUNDRY_ARTIFACTORY_REGISTRY_URL }}
       artifactory_repository_url: ${{ vars.TRUEFOUNDRY_ARTIFACTORY_PUBLIC_REPOSITORY }}
       image_artifact_name: trueforge-sandbox
@@ -33,9 +34,6 @@ jobs:
       platforms: linux/amd64
       enable_jfrog: true
       enable_public_ecr: false
-    secrets:
-      artifactory_username: ${{ secrets.TRUEFORGE_ARTIFACTORY_USERNAME }}
-      artifactory_password: ${{ secrets.TRUEFORGE_ARTIFACTORY_PASSWORD }}
 
   print-uri:
     name: Print pushed image URI
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8736bf4b0..5773f2f2c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -418,6 +418,7 @@ jobs:
       id-token: write
       contents: read
     with:
+      artifactory_oidc_provider_name: github-jfrog-trueforge
       # The shared build.yml inherits THIS run's github.sha, which is the
       # pre-version dispatch commit. version-release has already pushed the
       # bumped tree, so name it explicitly or the image ships the old
@@ -432,9 +433,6 @@ jobs:
       platforms: linux/amd64
       enable_jfrog: true
       enable_public_ecr: false
-    secrets:
-      artifactory_username: ${{ secrets.TRUEFORGE_ARTIFACTORY_USERNAME }}
-      artifactory_password: ${{ secrets.TRUEFORGE_ARTIFACTORY_PASSWORD }}
 
   build-image-private:
     name: Build and push hardened server image
@@ -449,6 +447,7 @@ jobs:
       id-token: write
       contents: read
     with:
+      artifactory_oidc_provider_name: github-jfrog-trueforge-private
       # Same reason as the public image: build the version commit, not the
       # dispatch commit.
       checkout_ref: ${{ needs.version-release.outputs.sha }}
@@ -470,8 +469,6 @@ jobs:
         RUNTIME_BASE_IMAGE=526077812922.dkr.ecr.us-east-1.amazonaws.com/tfy-internal/node:24
         VITE_POSTHOG_HOST=https://eu.i.posthog.com/
     secrets:
-      artifactory_username: ${{ secrets.TRUEFOUNDRY_ARTIFACTORY_PRIVATE_USERNAME }}
-      artifactory_password: ${{ secrets.TRUEFOUNDRY_ARTIFACTORY_PRIVATE_PASSWORD }}
       private_ecr_pull_role_arn: ${{ secrets.AWS_DEVTEST_ECR_IAM_ROLE_ARN }}
       # Caller with: has no secrets context; pass secret build-args here so the
       # shared workflow can append them to image_build_args.