diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 803f9e0..13de55d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -37,8 +37,13 @@ jobs:
     - name: Install dependencies
       run: yarn
 
+    - name: Configure AWS Credentials using OIDC
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        # TODO: update ACCOUNT and UPLOAD_ROLE
+        role-to-assume: arn:aws:iam::<ACCOUNT>:role/<UPLOAD_ROLE>
+        role-session-name: github-action-account-link-extension-publish
+        aws-region: us-west-1
+
     - name: Run Deploy
-      run: sh tools/cdn.sh
-      env:
-        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
\ No newline at end of file
+      run: sh tools/cdn.sh
\ No newline at end of file