diff --git a/.github/workflows/csharp-ci.yaml b/.github/workflows/csharp-ci.yaml
index 5ae1034..2601100 100644
--- a/.github/workflows/csharp-ci.yaml
+++ b/.github/workflows/csharp-ci.yaml
@@ -23,10 +23,10 @@ on:
     secrets:
       BOT_GITHUB_TOKEN:
         description: >-
-          PAT or GitHub App token with `read:packages` for `dotnet restore`
-          against private NuGet feeds (e.g. GitHub Packages). Optional;
-          omit for public-only restores. Pass via `secrets: inherit` or an
-          explicit `secrets:` block on the caller.
+          Deprecated and unused. `dotnet restore` runs without any credential and
+          resolves from nuget.org. Kept declared and optional so callers that name
+          it in an explicit `secrets:` block keep working; an inherited or passed
+          value is never exposed to the steps.
         required: false
     inputs:
       concurrency-group:
@@ -262,7 +262,6 @@ jobs:
         include: ${{ fromJSON(needs.normalize.outputs.matrix) }}
     permissions:
       contents: read
-      packages: read
       pull-requests: write
     defaults:
       run:
@@ -277,6 +276,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup .NET
         uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
@@ -292,6 +293,7 @@ jobs:
           repository: peacefulstudio/github-actions
           ref: ${{ job.workflow_sha }}
           path: .github-actions-helpers
+          persist-credentials: false
 
       - name: Resolve dotnet-coverage version
         if: ${{ matrix.coverage }}
@@ -310,9 +312,6 @@ jobs:
           "$GITHUB_WORKSPACE/.github-actions-helpers/scripts/install-dotnet-coverage.sh" "$DOTNET_COVERAGE_VERSION"
 
       - name: Restore
-        env:
-          GITHUB_USERNAME: ${{ github.actor }}
-          GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           dotnet restore
@@ -553,7 +552,6 @@ jobs:
     runs-on: ${{ inputs.plumbing-runner != '' && (startsWith(inputs.plumbing-runner, '[') && fromJSON(inputs.plumbing-runner) || inputs.plumbing-runner) || ((inputs.matrix-mode != '' && inputs.matrix-mode || vars.CI_MATRIX_MODE) == 'cheap' && github.event.repository.private == true && fromJSON('["self-hosted","hetzner"]') || 'ubuntu-latest') }}
     permissions:
       contents: read
-      packages: read
     defaults:
       run:
         shell: bash
@@ -579,6 +577,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup .NET
         uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
@@ -588,9 +588,6 @@ jobs:
           global-json-file: ${{ inputs.dotnet-version == '' && ((inputs.working-directory == '.' || inputs.working-directory == '') && 'global.json' || format('{0}/global.json', inputs.working-directory)) || '' }}
 
       - name: Restore
-        env:
-          GITHUB_USERNAME: ${{ github.actor }}
-          GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           dotnet restore
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6cfda5..02ea1a5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- `csharp-ci.yaml` runs `dotnet restore` and `dotnet pack` without any credential: the `Restore` steps no longer receive `secrets.BOT_GITHUB_TOKEN` or `github.token`, so no token is in the environment of steps that execute pull-request-controlled MSBuild files (`Directory.Build.props`, `nuget.config`, project targets), and the `actions/checkout` steps set `persist-credentials: false`. Every package resolves from nuget.org; the private GitHub Packages feed is retired, so no package "Manage Actions access" grants are needed. The `BOT_GITHUB_TOKEN` secret stays declared as optional and deprecated, so callers that name it in an explicit `secrets:` block do not break; its value is ignored.
+
 ## [2.6.0] - 2026-09-29
 
 ### Added
diff --git a/README.md b/README.md
index 9ea3cdc..9d2b107 100644
--- a/README.md
+++ b/README.md
@@ -151,12 +151,12 @@ choosing which shard carries coverage — use `build-matrix` instead (see
 | `pack`                        | `false`                  | When true, also runs `dotnet pack` and uploads `.nupkg` artifacts.                           |
 | `pack-project`                | *(empty)*                | Project to pack. Required when `pack: true`.                                                 |
 
-**Optional secrets**:
+**Restore is credential-free**: `dotnet restore` and `dotnet pack` run with no
+token and resolve every package from nuget.org. The private GitHub Packages feed
+is retired, so no package grants are needed.
 
-- `BOT_GITHUB_TOKEN` — PAT or GitHub App token with `read:packages` for
-  `dotnet restore` against private NuGet feeds (e.g. GitHub Packages).
-  Omit for public-only restores. Pass via `secrets: inherit` or an
-  explicit `secrets:` block on the caller.
+**Deprecated secret**: `BOT_GITHUB_TOKEN` is still accepted but unused, so
+callers that name it in an explicit `secrets:` block keep working.
 
 Consumer `.github/workflows/csharp-ci.yaml`: