diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 610fc82..3b08ab3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -252,6 +252,14 @@ jobs:
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
+      - name: Scope the Central credentials to central.sonatype.com
+        # Maven 3.10 offers the credentials of a settings server only to repositories declared with
+        # that id, and 'central' is also the id of Maven Central: without this origin the Central
+        # snapshot repository and publisher API get no credentials (401), see CONTRIBUTING.md.
+        run: |
+          sed -i 's|<id>central</id>|<id>central</id><repositoryOrigins><repositoryOrigin>https://central.sonatype.com</repositoryOrigin></repositoryOrigins>|' ~/.m2/settings.xml
+          grep -c '<repositoryOrigin>https://central.sonatype.com</repositoryOrigin>' ~/.m2/settings.xml
+
       - name: Publish snapshots
         # only a snapshot version: on release day main carries the release version for one
         # commit, and that one is published by release.yml from the tag
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1017320..03f8e9e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,6 +32,14 @@ jobs:
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
+      - name: Scope the Central credentials to central.sonatype.com
+        # Maven 3.10 offers the credentials of a settings server only to repositories declared with
+        # that id, and 'central' is also the id of Maven Central: without this origin the Central
+        # snapshot repository and publisher API get no credentials (401), see CONTRIBUTING.md.
+        run: |
+          sed -i 's|<id>central</id>|<id>central</id><repositoryOrigins><repositoryOrigin>https://central.sonatype.com</repositoryOrigin></repositoryOrigins>|' ~/.m2/settings.xml
+          grep -c '<repositoryOrigin>https://central.sonatype.com</repositoryOrigin>' ~/.m2/settings.xml
+
       - name: Check that the tag matches the project version
         run: |
           version=$(./mvnw -q -N --no-transfer-progress org.apache.maven.plugins:maven-help-plugin:3.5.1:evaluate -Dexpression=project.version -DforceStdout)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 32fa090..b8dd3cc 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -123,6 +123,14 @@ Snapshots of `main` are published by `ci.yml` to the
 repository variable `PUBLISH_SNAPSHOTS` is `true`. Consumers add that repository with
 `<snapshots><enabled>true</enabled></snapshots>`.
 
+Both workflows let `setup-java` write the `settings.xml` with the Central token as the server
+`central`, and then add `<repositoryOrigins>https://central.sonatype.com</repositoryOrigins>` to that
+server. Maven 3.10 offers the credentials of a settings server only to repositories whose origin it
+can associate with the server id, and `central` is also the id of Maven Central, so without the
+origin the uploads to `central.sonatype.com` get no credentials and fail with `401`. (The alternative,
+`-Dmaven.repository.credentialScope=id`, restores the id-only matching of Maven 3.9 for every
+server.)
+
 To try the release build locally without signing or uploading:
 `./mvnw -Prelease -Dgpg.skip verify`. With the key in the local keyring, set `MAVEN_GPG_PASSPHRASE`
 to sign as well; the passphrase never goes on the command line.