diff --git a/.github/workflows/deploy-backend.yml b/.github/workflows/deploy-backend.yml
index 6b6a7bb0..e45ba2f4 100644
--- a/.github/workflows/deploy-backend.yml
+++ b/.github/workflows/deploy-backend.yml
@@ -3,6 +3,10 @@ name: Deploy Backend (Azure Functions)
 on:
   workflow_dispatch:
 
+permissions:
+  id-token: write   # OIDC federated login (secret-less)
+  contents: read
+
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
@@ -11,10 +15,12 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - name: Login to Azure
+      - name: Login to Azure (OIDC)
         uses: azure/login@v3
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Setup .NET 8
         uses: actions/setup-dotnet@v5
diff --git a/.github/workflows/deploy-mcp.yml b/.github/workflows/deploy-mcp.yml
index 1adcbff8..add3af2b 100644
--- a/.github/workflows/deploy-mcp.yml
+++ b/.github/workflows/deploy-mcp.yml
@@ -3,6 +3,10 @@ name: Deploy MCP Server (Container App)
 on:
   workflow_dispatch:
 
+permissions:
+  id-token: write   # OIDC federated login (secret-less)
+  contents: read
+
 env:
   ACR_NAME: autopilotmonitoracr
   CONTAINER_APP_NAME: autopilotmonitor-mcp
@@ -17,10 +21,12 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - name: Login to Azure
+      - name: Login to Azure (OIDC)
         uses: azure/login@v3
         with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Login to ACR
         run: az acr login --name ${{ env.ACR_NAME }}
diff --git a/.github/workflows/oidc-login-test.yml b/.github/workflows/oidc-login-test.yml
new file mode 100644
index 00000000..72114b92
--- /dev/null
+++ b/.github/workflows/oidc-login-test.yml
@@ -0,0 +1,28 @@
+# TEMPORARY: proves the secret-less OIDC federated login works end-to-end.
+# Delete after the cross-tenant migration is verified (or keep as a cheap smoke test).
+name: OIDC Login Test
+
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  login-test:
+    runs-on: ubuntu-latest
+    name: Federated login + read check
+    steps:
+      - name: Login to Azure (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Prove identity and RBAC scope
+        run: |
+          az account show --query "{subscription:name, subscriptionId:id, tenantId:tenantId, user:user.name}" -o json
+          echo "--- function app visible with Contributor scope? ---"
+          az functionapp list --query "[].name" -o json