@@ -269,9 +269,17 @@ jobs:
           echo "$v" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+-SNAPSHOT$' \
             || { echo "::error::version '$v' is not a -SNAPSHOT — refusing scheduled deploy"; exit 1; }
 
+      # TEMPORARY -Dmaven.repository.credentialScope=id: Maven 3.10 (runner
+      # image) offers server credentials only to the origins bound to the id,
+      # and the id central is bound to repo.maven.apache.org, so the token
+      # never reaches central.sonatype.com (HTTP 401). Remove it once
+      # setup-java ships mvn-server-repository-origins (actions/setup-java#1282,
+      # release asked in actions/setup-java#1284) and set
+      #   mvn-server-repository-origins: central:https://central.sonatype.com
       - name: Deploy SNAPSHOT (main variant)
         run: >-
-          mvn -B -ntp -U -Pdeploy -Dgpg.skip=true -DskipTests deploy
+          mvn -B -ntp -U -Pdeploy -Dgpg.skip=true -DskipTests
+          -Dmaven.repository.credentialScope=id deploy
         env:
           CENTRAL_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
           CENTRAL_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
@@ -47,8 +47,10 @@ jobs:
           [ "$tag" = "$rev" ] \
             || { echo "::error::tag '$tag' does not match version '$rev'"; exit 1; }
 
+      # TEMPORARY -Dmaven.repository.credentialScope=id, see the deploy job
+      # of spec-build.yml
       - name: Build, test and deploy release
-        run: mvn -B -ntp -U -Pdeploy deploy
+        run: mvn -B -ntp -U -Pdeploy -Dmaven.repository.credentialScope=id deploy
         env:
           CENTRAL_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
           CENTRAL_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}