diff --git a/.github/maven-settings.xml b/.github/maven-settings.xml
new file mode 100644
index 00000000000..4d1f107082c
--- /dev/null
+++ b/.github/maven-settings.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Maven settings for publishing to Sonatype Central from CI.
+
+  Maven 3.10+ binds server credentials to repository origins. The 'central' server id
+  defaults to https://repo.maven.apache.org, so the Sonatype origin must be declared
+  explicitly or the credentials are withheld and uploads fail with HTTP 401.
+-->
+<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 https://maven.apache.org/xsd/settings-1.2.0.xsd">
+  <servers>
+    <server>
+      <id>central</id>
+      <username>${env.MAVEN_REPO_USERNAME}</username>
+      <password>${env.MAVEN_REPO_TOKEN}</password>
+      <repositoryOrigins>
+        <repositoryOrigin>https://central.sonatype.com</repositoryOrigin>
+      </repositoryOrigins>
+    </server>
+  </servers>
+</settings>
diff --git a/.github/workflows/cd-config.yml b/.github/workflows/cd-config.yml
index f7358b14606..01870e0e8e9 100644
--- a/.github/workflows/cd-config.yml
+++ b/.github/workflows/cd-config.yml
@@ -39,18 +39,15 @@ jobs:
           distribution: 'temurin'
           java-version: 17
           cache: 'maven'
-          server-id: 'central'
-          server-username: MAVEN_REPO_USERNAME
-          server-password: MAVEN_REPO_TOKEN
+          overwrite-settings: false
           gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }}
-          gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
       - name: Build the code with Maven
         run: mvn -B -ntp install -Pci
 
       - name: Deploy Artifacts
         if: ${{ github.actor != 'dependabot[bot]' }}
-        run: mvn deploy -P publish
+        run: mvn -B -s .github/maven-settings.xml deploy -P publish
         env:
           MAVEN_REPO_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
           MAVEN_REPO_TOKEN: ${{ secrets.SONATYPE_TOKEN }}