diff --git a/.github/workflows/publish-nuget.yml b/.github/workflows/publish-nuget.yml
index 542a4b44..b0ea3ccd 100644
--- a/.github/workflows/publish-nuget.yml
+++ b/.github/workflows/publish-nuget.yml
@@ -21,11 +21,8 @@ on:
         default: "ci-dotnet.yml"
         description: "Name of the workflow to check for successful builds"
     secrets:
-      NUGET_TOKEN:
-        required: false
-        description: "Legacy API key. Ignored when NUGET_USER is set (Trusted Publishing)."
       NUGET_USER:
-        required: false
+        required: true
         description: "nuget.org profile name for Trusted Publishing (OIDC)"
       WORKFLOW_PACKAGES:
         required: true
diff --git a/.github/workflows/step-dotnet-publish-nuget.yml b/.github/workflows/step-dotnet-publish-nuget.yml
index 9d56aa5a..87b389d6 100644
--- a/.github/workflows/step-dotnet-publish-nuget.yml
+++ b/.github/workflows/step-dotnet-publish-nuget.yml
@@ -21,11 +21,8 @@ on:
         default: "ci-dotnet.yml"
         description: "Name of the workflow to check for successful builds"
     secrets:
-      NUGET_TOKEN:
-        required: false
-        description: "Legacy API key. Ignored when NUGET_USER is set (Trusted Publishing)."
       NUGET_USER:
-        required: false
+        required: true
         description: "nuget.org profile name for Trusted Publishing (OIDC)"
       WORKFLOW_PACKAGES:
         required: true
@@ -56,13 +53,12 @@ jobs:
 
       - name: NuGet login (Trusted Publishing)
         id: login
-        if: ${{ env.NUGET_USER != '' }}
         uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
         with:
           user: ${{ env.NUGET_USER }}
 
       - name: Publish NuGet Package
         env:
-          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY || secrets.NUGET_TOKEN }}
+          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
         run: |
           dotnet nuget push packages/**/*.nupkg -k "$NUGET_API_KEY" -s https://api.nuget.org/v3/index.json --skip-duplicate
diff --git a/README.md b/README.md
index c82f5f10..61458bdf 100644
--- a/README.md
+++ b/README.md
@@ -236,7 +236,7 @@ jobs:
       runId: "1234567890" # Get this from the workflow run you want to publish
       environment: "nuget-production"
     secrets:
-      NUGET_TOKEN: ${{ secrets.NUGET_TOKEN }}
+      NUGET_USER: ${{ secrets.NUGET_USER }}
       WORKFLOW_PACKAGES: ${{ secrets.GITHUB_TOKEN }}
 ```
 
@@ -255,7 +255,7 @@ jobs:
 
 | Secret              | Description                               | Required |
 | ------------------- | ----------------------------------------- | -------- |
-| `NUGET_TOKEN`       | NuGet API key for publishing              | ✅       |
+| `NUGET_USER`        | nuget.org profile name (Trusted Publishing) | ✅     |
 | `WORKFLOW_PACKAGES` | GitHub token for workflow/artifact access | ✅       |
 
 **Prerequisites:**
@@ -568,7 +568,7 @@ jobs:
       runId: "123456789"
       workflowName: "build-dotnet-single.yml"
     secrets:
-      NUGET_TOKEN: ${{ secrets.NUGET_TOKEN }}
+      NUGET_USER: ${{ secrets.NUGET_USER }}
       WORKFLOW_PACKAGES: ${{ secrets.GITHUB_TOKEN }}
 ```
 
@@ -587,7 +587,7 @@ jobs:
 
 | Secret              | Description                | Required |
 | ------------------- | -------------------------- | -------- |
-| `NUGET_TOKEN`       | NuGet API key              | ✅       |
+| `NUGET_USER`        | nuget.org profile name (Trusted Publishing) | ✅ |
 | `WORKFLOW_PACKAGES` | GitHub token for artifacts | ✅       |
 
 **Note:** Consider using the higher-level `publish-nuget.yml` workflow instead for a more complete publishing solution.
@@ -731,7 +731,7 @@ jobs:
       runId: "1234567890" # Replace with actual workflow run ID
       environment: "nuget-production"
     secrets:
-      NUGET_TOKEN: ${{ secrets.NUGET_TOKEN }}
+      NUGET_USER: ${{ secrets.NUGET_USER }}
       WORKFLOW_PACKAGES: ${{ secrets.GITHUB_TOKEN }}
 ```
 
diff --git a/docs/MANUAL_APPROVAL_SETUP.md b/docs/MANUAL_APPROVAL_SETUP.md
index 15ede4d3..146840bc 100644
--- a/docs/MANUAL_APPROVAL_SETUP.md
+++ b/docs/MANUAL_APPROVAL_SETUP.md
@@ -36,7 +36,7 @@ In the environment configuration:
 If you need environment-specific secrets:
 
 1. In the environment configuration, scroll to **Environment secrets**
-2. Add any environment-specific secrets (e.g., different NUGET_TOKEN for staging vs production)
+2. Add any environment-specific secrets (e.g., different NUGET_USER for staging vs production)
 
 ## Usage Example
 
@@ -49,7 +49,7 @@ jobs:
     with:
       environment: "nuget-production"  # Your configured environment name
     secrets:
-      NUGET_TOKEN: ${{ secrets.NUGET_TOKEN }}
+      NUGET_USER: ${{ secrets.NUGET_USER }}
 ```
 
 ## Approval Process