diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 15f960c..6b71160 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -7,13 +7,38 @@ on:
       - '*.*.*'
   pull_request:
     branches: [ master ]
+
+permissions:
+  contents: read
+
 jobs:
   build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: '10.0.x'
+
+    - name: Run Unit Tests
+      run: |
+        dotnet restore
+        dotnet build
+        dotnet test test/NosCore.ParserInputGenerator.Tests -v m
+
+  release:
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup .NET
       uses: actions/setup-dotnet@v5
       with:
@@ -26,13 +51,7 @@ jobs:
             echo "match=true" >> $GITHUB_OUTPUT
         fi
 
-    - name: Run Unit Tests
-      run: |
-        dotnet restore
-        dotnet build
-        dotnet test test/NosCore.ParserInputGenerator.Tests -v m
-
-    - name: Build Artifact
+    - name: Pack and push to NuGet
       if: steps.check-tag.outputs.match == 'true'
       id: build_artifact
       run: |
@@ -45,6 +64,8 @@ jobs:
 
     - name: Upload Release Asset
       if: steps.check-tag.outputs.match == 'true'
-      uses: softprops/action-gh-release@v2
+      uses: softprops/action-gh-release@v3
       with:
         files: ${{ steps.build_artifact.outputs.ARTIFACT_PATH }}
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}