diff --git a/.tangled/workflows/deploy-gcp-dev.yml b/.tangled/workflows/deploy-gcp-dev.yml
index c1a275390..b92cb324c 100644
--- a/.tangled/workflows/deploy-gcp-dev.yml
+++ b/.tangled/workflows/deploy-gcp-dev.yml
@@ -14,6 +14,8 @@ when:
       - nix/pkgs/web-static-files.nix
       - .tangled/workflows/deploy-gcp-dev.yml
 
+audience: //iam.googleapis.com/projects/264757501569/locations/global/workloadIdentityPools/tangled-ci/providers/spindle
+
 engine: microvm
 image: nixos
 
@@ -28,6 +30,7 @@ environment:
   GCP_PROJECT: exemplary-proxy-507408-d6
   GCP_REGION: europe-north1
   REGISTRY: europe-north1-docker.pkg.dev/exemplary-proxy-507408-d6/tangled
+  WIF_PROVIDER: projects/264757501569/locations/global/workloadIdentityPools/tangled-ci/providers/spindle
   CI_SERVICE_ACCOUNT: ci-deployer-next@exemplary-proxy-507408-d6.iam.gserviceaccount.com
   IM_SERVICE_ACCOUNT: im-deployer-next@exemplary-proxy-507408-d6.iam.gserviceaccount.com
   DEPLOYMENT: tangled-dev
@@ -41,13 +44,15 @@ steps:
   - name: authenticate to gcp
     command: |
       set -eu
-      mkdir -p ~/.config/gcloud
-      printf '%s' "$GCP_CI_CREDENTIALS" > ~/.config/gcloud/application_default_credentials.json
-      gcloud auth application-default set-quota-project "$GCP_PROJECT" --quiet
+      umask 077
+      printf '%s' "$TANGLED_ID_TOKEN" > "$HOME/.tangled-id-token"
+      gcloud iam workload-identity-pools create-cred-config "$WIF_PROVIDER" \
+        --service-account="$CI_SERVICE_ACCOUNT" \
+        --credential-source-file="$HOME/.tangled-id-token" \
+        --output-file="$HOME/.gcp-wif.json"
+      gcloud auth login --cred-file="$HOME/.gcp-wif.json" --quiet
       gcloud config set project "$GCP_PROJECT" --quiet
-      gcloud auth application-default print-access-token \
-        --impersonate-service-account="$CI_SERVICE_ACCOUNT" > "$HOME/.gcp-token"
-      chmod 600 "$HOME/.gcp-token"
+      gcloud auth print-access-token > "$HOME/.gcp-token"
       docker login --username=oauth2accesstoken \
         --password="$(cat "$HOME/.gcp-token")" "$GCP_REGION-docker.pkg.dev"