diff --git a/.github/workflows/publish-store.yml b/.github/workflows/publish-store.yml
index db39b4848b..e21386665f 100644
--- a/.github/workflows/publish-store.yml
+++ b/.github/workflows/publish-store.yml
@@ -53,6 +53,7 @@ env:
 permissions:
   contents: read
   packages: read
+  id-token: write
 
 jobs:
     promote:
@@ -84,9 +85,18 @@ jobs:
             bundle install --jobs 4 --retry 3
 
         - name: Log in to Azure
-          uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
+          uses: bitwarden/gh-actions/azure-login@main
           with:
-            creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
+            subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+            tenant_id: ${{ secrets.AZURE_TENANT_ID }}
+            client_id: ${{ secrets.AZURE_CLIENT_ID }}
+
+        - name: Get Azure Key Vault secrets
+          id: get-kv-secrets
+          uses: bitwarden/gh-actions/get-keyvault-secrets@main
+          with:
+            keyvault: gh-android
+            secrets: "PLAY-BETA-KEYSTORE-PASSWORD,PLAY-BETA-KEY-PASSWORD"
 
         - name: Retrieve secrets
           env:
@@ -95,13 +105,16 @@ jobs:
           run: |
             mkdir -p ${{ github.workspace }}/secrets
             mkdir -p ${{ github.workspace }}/app/src/standardRelease
-            
+
             az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
             --name play_creds.json --file ${{ github.workspace }}/secrets/play_creds.json --output none
 
             az storage blob download --account-name $ACCOUNT_NAME --container-name $CONTAINER_NAME \
             --name authenticator_play_store-creds.json --file ${{ github.workspace }}/secrets/authenticator_play_store-creds.json --output none
 
+        - name: Log out from Azure
+          uses: bitwarden/gh-actions/azure-logout@main
+
         - name: Format Release Notes
           run: |
             FORMATTED_MESSAGE="$(echo "${{ inputs.release-notes }}" | sed 's/  /\n/g')"
@@ -110,8 +123,8 @@ jobs:
             echo "EOF" >> $GITHUB_ENV
         - name: Promote Play Store version to production
           env:
-            PLAY_KEYSTORE_PASSWORD: ${{ secrets.PLAY_BETA_KEYSTORE_PASSWORD }}
-            PLAY_KEY_PASSWORD: ${{ secrets.PLAY_BETA_KEY_PASSWORD }}
+            PLAY_KEYSTORE_PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-BETA-KEYSTORE-PASSWORD }}
+            PLAY_KEY_PASSWORD: ${{ steps.get-kv-secrets.outputs.PLAY-BETA-KEY-PASSWORD }}
             VERSION_CODE_INPUT: ${{ inputs.version-code }}
             VERSION_NAME: ${{inputs.version-name}}
             ROLLOUT_PERCENTAGE: ${{ inputs.rollout-percentage }}