diff --git a/.github/workflows/dart.yml b/.github/workflows/dart.yml
index 284f8d836..bae18ae95 100644
--- a/.github/workflows/dart.yml
+++ b/.github/workflows/dart.yml
@@ -93,4 +93,4 @@ jobs:
         run: nix develop .#dart -c ./payjoin-ffi/dart/contrib/prepare-publish.sh
 
       - name: Publish to pub.dev
-        run: nix develop .#dart -c bash -c 'cd payjoin-ffi/dart && dart pub publish --force'
+        run: nix develop .#dart -c ./payjoin-ffi/dart/contrib/publish.sh
diff --git a/flake.nix b/flake.nix
index 7d86c760e..3341fcc0e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -357,6 +357,8 @@
               rustVersions.msrv
               dart
               bzip2
+              curl
+              jq
             ]
             ++ lib.optionals pkgs.stdenv.isLinux [
               pkg-config
diff --git a/payjoin-ffi/dart/contrib/publish.sh b/payjoin-ffi/dart/contrib/publish.sh
new file mode 100755
index 000000000..e6917d551
--- /dev/null
+++ b/payjoin-ffi/dart/contrib/publish.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Publish the package to pub.dev via automated publishing (OIDC).
+# `dart pub publish` has no non-interactive authentication mode: without a
+# registered token it falls back to the browser sign-in flow and hangs the
+# job, so the runner-injected ACTIONS_ID_TOKEN_REQUEST_* variables (present
+# only in jobs granted `id-token: write`) are exchanged here for a
+# short-lived token that pub.dev verifies against the repository, tag
+# pattern, and environment configured on the package's admin page. This is
+# the same exchange the dart-lang/setup-dart action performs; we install
+# Dart through nix, so it has to happen here instead. Run
+# prepare-publish.sh first to generate the bindings that get packed.
+
+: "${ACTIONS_ID_TOKEN_REQUEST_URL:?must run in a GitHub Actions job with id-token: write}"
+: "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:?must run in a GitHub Actions job with id-token: write}"
+
+PUB_TOKEN="$(
+    curl --silent --show-error --fail --location \
+        --header "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+        "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://pub.dev" |
+        jq --raw-output .value
+)"
+export PUB_TOKEN
+dart pub token add https://pub.dev --env-var PUB_TOKEN
+
+cd "$(dirname "$0")/.."
+dart pub publish --force