diff --git a/.github/workflows/ci-publish.yml b/.github/workflows/ci-publish.yml
index 0ed2c58..79aa28e 100644
--- a/.github/workflows/ci-publish.yml
+++ b/.github/workflows/ci-publish.yml
@@ -2,15 +2,19 @@ name: CI / Build and Publish
 
 on:
   push:
-    branches: [ master ]
-    tags:   # publishing will only occur for version tags like v1.2.3
+    branches:
+      - master
+    tags:
       - 'v*'
+
   pull_request:
-    branches: [ master ]
+    branches:
+      - master
 
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+
     permissions:
       contents: read
       id-token: write
@@ -22,7 +26,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v3
+        uses: actions/setup-dotnet@v4
         with:
           dotnet-version: '8.0.x'
 
@@ -35,22 +39,39 @@ jobs:
       - name: Test
         run: dotnet test --configuration Release --no-build --verbosity normal
 
+      # Only create the NuGet package when a version tag is pushed
       - name: Pack SlaCore
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: bash
         run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+
+          echo "Packing SlaCore version $VERSION"
+
           mkdir -p artifacts
-          dotnet pack src/SlaCore/SlaCore.csproj -c Release -o ./artifacts /p:PackageVersion=1.0.${{ github.run_number }}
 
-      # Publish to NuGet when a tag is pushed (e.g. v1.0.0)
-      - name: NuGet login (OIDC 10 temp API key)
-        if: startsWith(github.ref, 'refs/tags/')
+          dotnet pack src/SlaCore/SlaCore.csproj \
+            --configuration Release \
+            --no-build \
+            --output ./artifacts \
+            /p:PackageVersion=$VERSION
+
+      # Exchange GitHub OIDC token for a temporary NuGet API key
+      - name: NuGet login
+        if: startsWith(github.ref, 'refs/tags/v')
         uses: NuGet/login@v1
         id: login
         with:
           user: ${{ secrets.NUGET_USER }}
 
-      - name: NuGet push
-        if: startsWith(github.ref, 'refs/tags/')
+      # Publish to NuGet.org
+      - name: Publish to NuGet.org
+        if: startsWith(github.ref, 'refs/tags/v')
         run: |
-          echo "Packages in artifacts:"
+          echo "Publishing packages:"
           ls -la artifacts
-          dotnet nuget push "artifacts/*.nupkg" --api-key ${{ steps.login.outputs.NUGET_API_KEY }} --source https://api.nuget.org/v3/index.json --skip-duplicate
+
+          dotnet nuget push "artifacts/*.nupkg" \
+            --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" \
+            --source "https://api.nuget.org/v3/index.json" \
+            --skip-duplicate
\ No newline at end of file