diff --git a/build.gradle b/build.gradle
index c5911ab266..7cf554de17 100644
--- a/build.gradle
+++ b/build.gradle
@@ -88,18 +88,26 @@ task publish {
 ext {
 	// look for command-line overrides of the username/password pairs for publishing
 	if ( project.hasProperty( 'hibernatePublishUsername' ) ) {
+		if ( ! project.hasProperty( 'hibernatePublishPassword' ) ) {
+			throw new GradleException( "Should specify both `hibernatePublishUsername` and `hibernatePublishPassword` as project properties" );
+		}
 		credentials.hibernatePublishUsername = project.property( 'hibernatePublishUsername' )
-	}
-	if ( project.hasProperty( 'hibernatePublishPassword' ) ) {
 		credentials.hibernatePublishPassword = project.property( 'hibernatePublishPassword' )
 	}
+	else if ( System.properties.hibernatePublishUsername != null ) {
+		if ( System.properties.hibernatePublishPassword == null ) {
+			throw new GradleException( "Should specify both `hibernatePublishUsername` and `hibernatePublishPassword` as system properties" );
+		}
+		credentials.hibernatePublishUsername = System.properties.hibernatePublishUsername
+		credentials.hibernatePublishPassword = System.properties.hibernatePublishPassword
+	}
 }
 
 nexusPublishing {
 	repositories {
 		sonatype {
-			username = project.credentials.hibernatePublishUsername
-			password = project.credentials.hibernatePublishPassword
+			username = credentials.hibernatePublishUsername
+			password = credentials.hibernatePublishPassword
 		}
 	}
 }
@@ -118,12 +126,12 @@ gradle.taskGraph.addTaskExecutionGraphListener(
 
 				for ( String taskToLookFor : tasksToLookFor ) {
 					if ( graph.hasTask( taskToLookFor ) ) {
-						// trying to publish - make sure the needed tokens are available
+						// trying to publish - make sure the needed credentials are available
 
-						if ( project.credentials.hibernatePublishUsername == null ) {
+						if ( credentials.hibernatePublishUsername == null ) {
 							throw new GradleException( "Publishing credentials not specified" );
 						}
-						if ( project.credentials.hibernatePublishPassword == null ) {
+						if ( credentials.hibernatePublishPassword == null ) {
 							throw new GradleException( "Publishing credentials not specified" );
 						}
 
diff --git a/tooling/hibernate-gradle-plugin/hibernate-gradle-plugin.gradle b/tooling/hibernate-gradle-plugin/hibernate-gradle-plugin.gradle
index 10936ae731..f3ddf4a63e 100644
--- a/tooling/hibernate-gradle-plugin/hibernate-gradle-plugin.gradle
+++ b/tooling/hibernate-gradle-plugin/hibernate-gradle-plugin.gradle
@@ -22,18 +22,20 @@ ext {
 	pluginId = 'org.hibernate.orm'
 	pluginVersion = project.version
 
+	// look for command-line overrides of the username/password pairs for publishing
 	if ( project.hasProperty( 'hibernatePluginPortalUsername' ) ) {
+		if ( ! project.hasProperty( 'hibernatePluginPortalPassword' ) ) {
+			throw new GradleException( "Should specify both `hibernatePluginPortalUsername` and `hibernatePluginPortalPassword` as project properties" );
+		}
 		credentials.hibernatePluginPortalUsername = project.property( 'hibernatePluginPortalUsername' )
-	}
-	if ( credentials.hibernatePluginPortalUsername != null ) {
-		project.setProperty( 'gradle.publish.key', credentials.hibernatePluginPortalUsername )
-	}
-
-	if ( project.hasProperty( 'hibernatePluginPortalPassword' ) ) {
 		credentials.hibernatePluginPortalPassword = project.property( 'hibernatePluginPortalPassword' )
 	}
-	if ( credentials.hibernatePluginPortalPassword != null ) {
-		project.setProperty( 'gradle.publish.secret', credentials.hibernatePluginPortalPassword )
+	else if ( System.properties.hibernatePluginPortalUsername != null ) {
+		if ( System.properties.hibernatePluginPortalPassword == null ) {
+			throw new GradleException( "Should specify both `hibernatePluginPortalUsername` and `hibernatePluginPortalPassword` as system properties" );
+		}
+		credentials.hibernatePluginPortalUsername = System.properties.hibernatePluginPortalUsername
+		credentials.hibernatePluginPortalPassword = System.properties.hibernatePluginPortalPassword
 	}
 }