diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df1cf425d..7953e44ed 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,12 +43,15 @@ jobs:
         run: ./gradlew ${{ env.GRADLE_SWITCHES }} build
       - name: publish-snapshots
         if: github.event_name != 'pull_request'
-        run: ./gradlew ${{ env.GRADLE_SWITCHES }} snapshot :plugin:publishPluginMavenPublicationToSonatypeRepository -x test -x publishPlugins
+        run: ./gradlew ${{ env.GRADLE_SWITCHES }} snapshot :plugin:publishPluginMavenPublicationToCgpRepository -x test -x publishPlugins
         env:
-          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.SONATYPE_USERNAME }}
-          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.SONATYPE_TOKEN }}
-          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.OSSRH_SIGNING_KEY }}
-          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.OSSRH_SIGNING_PASSWORD }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.CGP_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CGP_AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: us-west-2
+          # Gradle's own s3:// transport still bundles AWS SDK for Java 1.x, which prints a
+          # deprecation banner with a stack trace on every upload. Drop once Gradle ships
+          # https://github.com/gradle/gradle/pull/29686 (milestone 9.8.0).
+          AWS_JAVA_V1_DISABLE_DEPRECATION_ANNOUNCEMENT: true
 
   notify:
     if: (failure() || cancelled()) && github.event_name == 'schedule' && (github.repository_owner == 'openrewrite' || github.repository_owner == 'moderneinc')
diff --git a/README.md b/README.md
index 2ab8c2372..401d14283 100644
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ rewrite {
 }
 ```
 
-### Consuming latest snapshots from OSSRH
+### Consuming latest snapshots from the Code Genome Project
 
 To use the latest `-SNAPSHOT` of the `rewrite-gradle-plugin`, update your project's `settings.gradle.kts`:
 
@@ -54,7 +54,11 @@ pluginManagement {
     repositories {
         // ...
         maven {
-            url = uri("https://central.sonatype.com/repository/maven-snapshots/")
+            url = uri("https://artifacts.codegenomeproject.org/maven")
+            credentials {
+                username = "USERNAME"
+                password = "TOKEN"
+            }
         }
         // ...
         // you'll likely also need this if you don't have a pluginManagement section already:
@@ -64,6 +68,10 @@ pluginManagement {
 }
 ```
 
+The [Code Genome Project](https://codegenomeproject.org/) repository requires authentication.
+[Sign in to get a download token](https://codegenomeproject.org/token), then replace `USERNAME` with
+the email or username you signed in with and `TOKEN` with that token.
+
 The plugin can be consumed in your `build.gradle.kts`:
 
 ```kts
diff --git a/build.gradle.kts b/build.gradle.kts
index 2a7391975..52d6802d6 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -1,6 +1,5 @@
 plugins {
     id("nebula.release") version "latest.release"
-    id("io.github.gradle-nexus.publish-plugin") version "latest.release"
     id("org.owasp.dependencycheck") version "latest.release" apply false
     id("nebula.maven-resolved-dependencies") version "latest.release" apply false
     id("nebula.maven-apache-license") version "latest.release" apply false
@@ -44,13 +43,4 @@ allprojects {
     }
 }
 
-nexusPublishing {
-    repositories {
-        sonatype {
-            nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
-            snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
-        }
-    }
-}
-
 evaluationDependsOn(":plugin")
diff --git a/plugin/build.gradle.kts b/plugin/build.gradle.kts
index d0d068978..3771bdd6a 100644
--- a/plugin/build.gradle.kts
+++ b/plugin/build.gradle.kts
@@ -40,11 +40,12 @@ repositories {
         }
     }
 
-    val codegenomeUsername = providers.gradleProperty("codegenomeUsername").orNull
-    val codegenomePassword = providers.gradleProperty("codegenomePassword").orNull
-    if (!codegenomeUsername.isNullOrEmpty() && !codegenomePassword.isNullOrEmpty()) {
-        // CGP is the first publish target for both snapshots and releases, so consult it
-        // ahead of Sonatype and Maven Central; group-scoped to the artifacts it serves.
+    val codegenomeUsername = providers.gradleProperty("codegenomeUsername").getOrElse("")
+    val codegenomePassword = providers.gradleProperty("codegenomePassword").getOrElse("")
+    val codegenomeConfigured = codegenomeUsername.isNotEmpty() && codegenomePassword.isNotEmpty()
+    if (codegenomeConfigured) {
+        // CGP is the only source of org.openrewrite and io.moderne artifacts; group-scoped to
+        // the artifacts it serves so an outage can't break resolution of third-party releases.
         maven {
             name = "codegenome"
             url = uri("https://artifacts.codegenomeproject.org/maven")
@@ -59,28 +60,43 @@ repositories {
         }
     }
 
-    if (!releasing) {
-        maven {
-            url = uri("https://central.sonatype.com/repository/maven-snapshots")
-            // Only consult the snapshots repo for groups that actually publish snapshots we consume,
-            // so a snapshots-repo outage can't break resolution of third-party releases.
-            mavenContent {
-                includeGroupAndSubgroups("org.openrewrite")
-                includeGroupAndSubgroups("io.moderne")
-            }
-        }
-    }
-
     mavenCentral {
         mavenContent {
             excludeVersionByRegex(".+", ".+", ".+-rc-?[0-9]*")
+            if (codegenomeConfigured) {
+                excludeGroupAndSubgroups("org.openrewrite")
+                excludeGroupAndSubgroups("io.moderne")
+            }
         }
     }
 
-    gradlePluginPortal()
+    // The plugin portal proxies Maven Central, so it needs the same exclusion to keep these groups on CGP
+    gradlePluginPortal {
+        if (codegenomeConfigured) {
+            (this as MavenArtifactRepository).content {
+                excludeGroupAndSubgroups("org.openrewrite")
+                excludeGroupAndSubgroups("io.moderne")
+            }
+        }
+    }
     google()
 }
 
+publishing {
+    repositories {
+        // Region-qualified host, else Gradle's S3 transport defaults to us-east-1 (the bucket is us-west-2).
+        maven {
+            name = "cgp"
+            url = uri("s3://codegenome-artifacts.s3.us-west-2.amazonaws.com/maven")
+            credentials(AwsCredentials::class) {
+                accessKey = System.getenv("AWS_ACCESS_KEY_ID")
+                secretKey = System.getenv("AWS_SECRET_ACCESS_KEY")
+                sessionToken = System.getenv("AWS_SESSION_TOKEN")
+            }
+        }
+    }
+}
+
 val latest = if (project.hasProperty("releasing")) {
     "latest.release"
 } else {