diff --git a/.github/workflows/azure-upload.yml b/.github/workflows/azure-upload.yml
index 825a1eba8..5f1107aef 100644
--- a/.github/workflows/azure-upload.yml
+++ b/.github/workflows/azure-upload.yml
@@ -10,6 +10,7 @@ jobs:
   azure-upload:
     permissions:
       contents: write
+      id-token: write  # for OIDC authentication
     name: Azure Upload Release
     runs-on: ubuntu-22.04
     steps:
@@ -56,7 +57,9 @@ jobs:
       - name: Azure Login
         uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZ_KEYVAULT_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZ_KEYVAULT_TENANT_ID }}
+          subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}
       - name: Azure Upload Release Packages
         uses: azure/CLI@9eb25b8360668fb0ecbafa808d40e2197b2f5f52 # v3.0.0
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 31db683ab..6b00e9791 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -412,6 +412,9 @@ jobs:
   build-signed-snapshot:
     name: Build signed snapshot
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write  # for OIDC authentication
+      contents: read
     if: ${{ !startsWith(github.ref_name, 'release-') && !startsWith(github.ref_name, 'dependabot/') && !github.event.pull_request.head.repo.fork }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -450,7 +453,9 @@ jobs:
       - name: Azure Login
         uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZ_KEYVAULT_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZ_KEYVAULT_TENANT_ID }}
+          subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}
       - name: Azure Upload Snapshot
         uses: azure/CLI@9eb25b8360668fb0ecbafa808d40e2197b2f5f52 # v3.0.0
         with:
diff --git a/.github/workflows/release-branch.yml b/.github/workflows/release-branch.yml
index 959901d47..dc65407ac 100644
--- a/.github/workflows/release-branch.yml
+++ b/.github/workflows/release-branch.yml
@@ -192,10 +192,10 @@ jobs:
           script: |
             const { repo, owner } = context.repo;
             const result = await github.rest.pulls.create({
-              title: 'Merge ${{ github.ref_name }} back into dev-v2',
+              title: 'Merge ${{ inputs.releaseBranch }} back into dev-v2',
               owner,
               repo,
-              head: '${{ github.ref_name }}',
+              head: '${{ inputs.releaseBranch }}',
               base: 'dev-v2',
               body: [
                 'This PR is auto-generated by the release branch workflow.'