diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index d1a96a34..4fa0b4c0 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -51,17 +51,9 @@ jobs:
         with:
           java-version: 17
           distribution: 'temurin'
-          # do not cache to ensure we can resolve dependencies
-          server-id: 'github-flatmap'
-          server-username: MAVEN_USERNAME
-          server-password: MAVEN_PASSWORD
       - name: Build and test
         run: mvn --batch-mode -no-transfer-progress package --file pom.xml
         working-directory: flatmap-examples
-        # workaround for github maven packages not supporting anonymous access
-        env:
-          MAVEN_USERNAME: 'flatmapbot'
-          MAVEN_PASSWORD: '${{ secrets.PACKAGE_TOKEN }}'
       - name: Find jar
         run: mv target/*with-deps.jar ./run.jar
         working-directory: flatmap-examples
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 79498c6d..cf8f537d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,6 +33,9 @@ jobs:
           java-version: '17'
           distribution: 'temurin'
           cache: 'maven'
+          server-id: ossrh
+          server-username: MAVEN_USERNAME
+          server-password: MAVEN_PASSWORD
 
       - name: Check tag does not exist yet
         run: if git rev-list "v${{ github.event.inputs.version }}"; then echo "Tag already exists. Aborting the release process."; exit 1; fi
@@ -60,6 +63,9 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Install GPG Private Key
+        run: |
+          echo -n "${{ secrets.OSSRH_GPG_SECRET_KEY }}" | base64 --decode | gpg --batch --import
       - name: Create Release
         uses: softprops/action-gh-release@v1
         with:
@@ -74,3 +80,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           IMAGE_TAGS: ${{ github.event.inputs.image_tags }}
+          MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+          OSSRH_GPG_SECRET_KEY_PASSWORD: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml
index 6ee21b82..1b1096fc 100644
--- a/.github/workflows/snapshot.yml
+++ b/.github/workflows/snapshot.yml
@@ -28,6 +28,9 @@ jobs:
           java-version: 17
           distribution: 'temurin'
           cache: 'maven'
+          server-id: ossrh
+          server-username: MAVEN_USERNAME
+          server-password: MAVEN_PASSWORD
       - run: ./scripts/build-release.sh
       - run: ./scripts/test-release.sh
       - name: Log in to the Container Registry
@@ -36,7 +39,13 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Install GPG Private Key
+        run: |
+          echo -n "${{ secrets.OSSRH_GPG_SECRET_KEY }}" | base64 --decode | gpg --batch --import
       - run: ./scripts/push-release.sh
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           IMAGE_TAGS: ${{ github.event.inputs.image_tags }}
+          MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+          OSSRH_GPG_SECRET_KEY_PASSWORD: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
diff --git a/flatmap-examples/README.md b/flatmap-examples/README.md
index be7b8331..70db90d5 100644
--- a/flatmap-examples/README.md
+++ b/flatmap-examples/README.md
@@ -36,20 +36,6 @@ First, make a copy of this example project. It contains:
 - [src/test/java/com/onthegomap/flatmap/examples](src/main/java/com/onthegomap/flatmap/examples)
   unit and integration tests for each of the map generators
 
-Until Flatmap gets into Maven Central, to resolve `flatmap-core` dependencies, you will need to create
-a [GitHub personal access token](https://github.com/settings/tokens) with `read:packages` scope, then add the following
-to your `~/.m2/settings.xml`:
-
-```xml
-<servers>
-  <server>
-    <id>github-flatmap</id>
-    <username>username</username>
-    <password>token</password>
-  </server>
-</servers>
-```
-
 Then, create a new class that implements `com.onthegomap.flatmap.Profile`:
 
 ```java
diff --git a/flatmap-examples/pom.xml b/flatmap-examples/pom.xml
index 8fb6ae95..ead088e8 100644
--- a/flatmap-examples/pom.xml
+++ b/flatmap-examples/pom.xml
@@ -36,15 +36,15 @@
         <enabled>true</enabled>
       </releases>
     </repository>
-    <!-- TODO get flatmap into maven central and remove this: -->
     <repository>
-      <id>github-flatmap</id>
-      <url>https://maven.pkg.github.com/onthegomap/flatmap</url>
+      <id>nexus-snapshots</id>
+      <name>Nexus SNAPSHOT Repository</name>
+      <url>https://s01.oss.sonatype.org/content/repositories/snapshots/</url>
       <snapshots>
         <enabled>true</enabled>
       </snapshots>
       <releases>
-        <enabled>true</enabled>
+        <enabled>false</enabled>
       </releases>
     </repository>
   </repositories>
diff --git a/pom.xml b/pom.xml
index e2f545dd..76ad07a5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -64,10 +64,13 @@
   </repositories>
 
   <distributionManagement>
+    <snapshotRepository>
+      <id>ossrh</id>
+      <url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
+    </snapshotRepository>
     <repository>
-      <id>github</id>
-      <name>GitHub Packages</name>
-      <url>https://maven.pkg.github.com/onthegomap/flatmap</url>
+      <id>ossrh</id>
+      <url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
     </repository>
   </distributionManagement>
 
@@ -227,8 +230,8 @@
               <id>attach-sources</id>
               <phase>package</phase>
               <goals>
-                <goal>jar</goal>
-                <goal>test-jar</goal>
+                <goal>jar-no-fork</goal>
+                <goal>test-jar-no-fork</goal>
               </goals>
             </execution>
           </executions>
@@ -286,6 +289,7 @@
                 <id>attach-sources</id>
                 <goals>
                   <goal>jar-no-fork</goal>
+                  <goal>test-jar-no-fork</goal>
                 </goals>
               </execution>
             </executions>
diff --git a/scripts/push-release.sh b/scripts/push-release.sh
index a1a12030..a25104f4 100755
--- a/scripts/push-release.sh
+++ b/scripts/push-release.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-set -euxo pipefail
+set -euo pipefail
 
 version="${1:-$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)}"
 
@@ -13,4 +13,4 @@ do
   docker image push ghcr.io/onthegomap/flatmap:"${TAG}"
 done
 
-./mvnw -B -DskipTests deploy
+./mvnw -B -Dgpg.passphrase="${OSSRH_GPG_SECRET_KEY_PASSWORD}" -DskipTests -Prelease deploy