diff --git a/.github/workflows/shared-run-e2e-tests.yaml b/.github/workflows/shared-run-e2e-tests.yaml
index 7512d04a..8edf041d 100644
--- a/.github/workflows/shared-run-e2e-tests.yaml
+++ b/.github/workflows/shared-run-e2e-tests.yaml
@@ -73,6 +73,19 @@ on:
         description: The AWS PCR0
         type: string
 
+      azure_client_id:
+        description: The Azure application client ID for OIDC login
+        type: string
+      azure_tenant_id:
+        description: The Azure tenant ID for OIDC login
+        type: string
+      azure_subscription_id:
+        description: The Azure subscription ID for OIDC login
+        type: string
+      azure_environment:
+        description: The GitHub environment used for Azure OIDC login
+        type: string
+
 env:
   REGISTRY: ghcr.io
 
@@ -106,6 +119,7 @@ jobs:
     name: E2E Test
     # The pinned azure-cli is not in Microsoft's apt repo for Ubuntu 26.04 (ubuntu-latest).
     runs-on: ${{ inputs.operator_type == 'aks' && 'ubuntu-24.04' || 'ubuntu-latest' }}
+    environment: ${{ inputs.azure_environment }}
     permissions:
       contents: write
       packages: read
@@ -220,7 +234,9 @@ jobs:
         if: ${{ inputs.operator_type == 'aks' }}
         uses: IABTechLab/uid2-shared-actions/actions/start_aks_cluster@v3
         with:
-          azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
+          azure_client_id: ${{ inputs.azure_client_id }}
+          azure_tenant_id: ${{ inputs.azure_tenant_id }}
+          azure_subscription_id: ${{ inputs.azure_subscription_id }}
           run_id: ${{ github.run_id }}
 
       - name: Get AKS operator key
@@ -283,7 +299,9 @@ jobs:
           bore_url_optout: ${{ steps.bore.outputs.bore_url_optout }}
           template_file: ${{ steps.prepare_azure_metadata.outputs.template_file }}
           parameters_file: ${{ steps.prepare_azure_metadata.outputs.parameters_file }}
-          azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
+          azure_client_id: ${{ inputs.azure_client_id }}
+          azure_tenant_id: ${{ inputs.azure_tenant_id }}
+          azure_subscription_id: ${{ inputs.azure_subscription_id }}
           target_environment: ${{ inputs.target_environment }}
 
       - name: Start AWS private operator
@@ -306,7 +324,9 @@ jobs:
         uses: IABTechLab/uid2-shared-actions/actions/start_aks_private_operator@v3
         with:
           template_file: ${{ steps.prepare_aks_metadata.outputs.template_file }}
-          azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
+          azure_client_id: ${{ inputs.azure_client_id }}
+          azure_tenant_id: ${{ inputs.azure_tenant_id }}
+          azure_subscription_id: ${{ inputs.azure_subscription_id }}
           run_id: ${{ github.run_id }}
 
       - name: Decide E2E test environment variables
@@ -406,7 +426,9 @@ jobs:
         if: ${{ inputs.operator_type == 'azure' }}
         uses: IABTechLab/uid2-shared-actions/actions/stop_azure_private_operator@v3
         with:
-          azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
+          azure_client_id: ${{ inputs.azure_client_id }}
+          azure_tenant_id: ${{ inputs.azure_tenant_id }}
+          azure_subscription_id: ${{ inputs.azure_subscription_id }}
           azure_container_group_name: ${{ needs.e2e-test.outputs.azure_container_group_name }}
 
       - name: Stop AWS private operator
@@ -426,5 +448,7 @@ jobs:
         if: ${{ inputs.operator_type == 'aks' }}
         uses: IABTechLab/uid2-shared-actions/actions/stop_aks_private_operator@v3
         with:
-          azure_credentials: ${{ secrets.AZURE_CREDENTIALS }}
+          azure_client_id: ${{ inputs.azure_client_id }}
+          azure_tenant_id: ${{ inputs.azure_tenant_id }}
+          azure_subscription_id: ${{ inputs.azure_subscription_id }}
           run_id: ${{ github.run_id }}
diff --git a/actions/start_aks_cluster/action.yaml b/actions/start_aks_cluster/action.yaml
index e084321f..42cb3f60 100644
--- a/actions/start_aks_cluster/action.yaml
+++ b/actions/start_aks_cluster/action.yaml
@@ -2,8 +2,14 @@ name: Start AKS Cluster
 description: Creates the AKS cluster and infrastructure
 
 inputs:
-  azure_credentials:
-    description: The Azure credentials
+  azure_client_id:
+    description: The Azure application client ID for OIDC login
+    required: true
+  azure_tenant_id:
+    description: The Azure tenant ID for OIDC login
+    required: true
+  azure_subscription_id:
+    description: The Azure subscription ID for OIDC login
     required: true
   run_id:
     description: Unique run identifier for resource naming
@@ -13,10 +19,12 @@ runs:
   using: "composite"
 
   steps:
-    - name: Log in to Azure
+    - name: Log in to Azure with OIDC
       uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
       with:
-        creds: ${{ inputs.azure_credentials }}
+        client-id: ${{ inputs.azure_client_id }}
+        tenant-id: ${{ inputs.azure_tenant_id }}
+        subscription-id: ${{ inputs.azure_subscription_id }}
         enable-AzPSSession: true
 
     - name: Start AKS cluster
diff --git a/actions/start_aks_private_operator/action.yaml b/actions/start_aks_private_operator/action.yaml
index bd35014e..aee6232c 100644
--- a/actions/start_aks_private_operator/action.yaml
+++ b/actions/start_aks_private_operator/action.yaml
@@ -5,8 +5,14 @@ inputs:
   template_file:
     description: The template file
     required: true
-  azure_credentials:
-    description: The Azure credentials
+  azure_client_id:
+    description: The Azure application client ID for OIDC login
+    required: true
+  azure_tenant_id:
+    description: The Azure tenant ID for OIDC login
+    required: true
+  azure_subscription_id:
+    description: The Azure subscription ID for OIDC login
     required: true
   run_id:
     description: Unique run identifier for resource naming
@@ -21,10 +27,12 @@ runs:
   using: "composite"
 
   steps:
-    - name: Log in to Azure
+    - name: Log in to Azure with OIDC
       uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
       with:
-        creds: ${{ inputs.azure_credentials }}
+        client-id: ${{ inputs.azure_client_id }}
+        tenant-id: ${{ inputs.azure_tenant_id }}
+        subscription-id: ${{ inputs.azure_subscription_id }}
         enable-AzPSSession: true
 
     - name: Start AKS private operator
diff --git a/actions/start_azure_private_operator/action.yaml b/actions/start_azure_private_operator/action.yaml
index c48caac9..e0afba67 100644
--- a/actions/start_azure_private_operator/action.yaml
+++ b/actions/start_azure_private_operator/action.yaml
@@ -14,8 +14,14 @@ inputs:
   parameters_file:
     description: The parameters file
     required: true
-  azure_credentials:
-    description: The Azure credentials
+  azure_client_id:
+    description: The Azure application client ID for OIDC login
+    required: true
+  azure_tenant_id:
+    description: The Azure tenant ID for OIDC login
+    required: true
+  azure_subscription_id:
+    description: The Azure subscription ID for OIDC login
     required: true
   target_environment:
     description: The target environment [mock, integ, prod]
@@ -33,10 +39,12 @@ runs:
   using: "composite"
 
   steps:
-    - name: Log in to Azure
+    - name: Log in to Azure with OIDC
       uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
       with:
-        creds: ${{ inputs.azure_credentials }}
+        client-id: ${{ inputs.azure_client_id }}
+        tenant-id: ${{ inputs.azure_tenant_id }}
+        subscription-id: ${{ inputs.azure_subscription_id }}
         enable-AzPSSession: true
 
     - name: Start Azure private operator
diff --git a/actions/stop_aks_private_operator/action.yaml b/actions/stop_aks_private_operator/action.yaml
index 583a924d..d772868b 100644
--- a/actions/stop_aks_private_operator/action.yaml
+++ b/actions/stop_aks_private_operator/action.yaml
@@ -2,8 +2,14 @@ name: Stop AKS Private Operator
 description: Spins down an AKS private operator
 
 inputs:
-  azure_credentials:
-    description: The Azure credentials
+  azure_client_id:
+    description: The Azure application client ID for OIDC login
+    required: true
+  azure_tenant_id:
+    description: The Azure tenant ID for OIDC login
+    required: true
+  azure_subscription_id:
+    description: The Azure subscription ID for OIDC login
     required: true
   run_id:
     description: Unique run identifier for resource naming
@@ -13,10 +19,12 @@ runs:
   using: "composite"
 
   steps:
-    - name: Log in to Azure
+    - name: Log in to Azure with OIDC
       uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
       with:
-        creds: ${{ inputs.azure_credentials }}
+        client-id: ${{ inputs.azure_client_id }}
+        tenant-id: ${{ inputs.azure_tenant_id }}
+        subscription-id: ${{ inputs.azure_subscription_id }}
         enable-AzPSSession: true
 
     - name: Stop AKS private operator
diff --git a/actions/stop_azure_private_operator/action.yaml b/actions/stop_azure_private_operator/action.yaml
index 82c97dd4..29fc3014 100644
--- a/actions/stop_azure_private_operator/action.yaml
+++ b/actions/stop_azure_private_operator/action.yaml
@@ -2,8 +2,14 @@ name: Stop Azure Private Operator
 description: Spins down an Azure private operator
 
 inputs:
-  azure_credentials:
-    description: The Azure credentials
+  azure_client_id:
+    description: The Azure application client ID for OIDC login
+    required: true
+  azure_tenant_id:
+    description: The Azure tenant ID for OIDC login
+    required: true
+  azure_subscription_id:
+    description: The Azure subscription ID for OIDC login
     required: true
   azure_container_group_name:
     description: The Azure instance name
@@ -13,10 +19,12 @@ runs:
   using: "composite"
 
   steps:
-    - name: Log in to Azure
+    - name: Log in to Azure with OIDC
       uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
       with:
-        creds: ${{ inputs.azure_credentials }}
+        client-id: ${{ inputs.azure_client_id }}
+        tenant-id: ${{ inputs.azure_tenant_id }}
+        subscription-id: ${{ inputs.azure_subscription_id }}
         enable-AzPSSession: true
 
     - name: Stop Azure private operator