diff --git a/.github/workflows/versioning.yaml b/.github/workflows/versioning.yaml
index dc19175..058337c 100644
--- a/.github/workflows/versioning.yaml
+++ b/.github/workflows/versioning.yaml
@@ -47,6 +47,12 @@ jobs:
       name: Publish to PyPI
       if: (github.event.head_commit.message == 'Update package version')
       runs-on: ubuntu-latest
+      # PyPI trusted publishing: uploads accepted only from this workflow in
+      # the pypi environment (limited to main). No stored token.
+      environment: pypi
+      permissions:
+        contents: write # publish-git-tag.sh pushes the release tag
+        id-token: write # OIDC token for PyPI trusted publishing
       steps:
         - name: Checkout code
           uses: actions/checkout@v6
@@ -56,8 +62,10 @@ jobs:
           uses: actions/setup-python@v6
           with:
             python-version: 3.13
-        - name: Install package
-          run: make install
+        # Building the wheel needs only the build tool. The dev extras pin
+        # policyengine-us==1.667.1, which is no longer on PyPI.
+        - name: Install build tool
+          run: pip install build
         - name: Build package
           run: python -m build
         - name: Publish a git tag
@@ -65,6 +73,4 @@ jobs:
         - name: Publish to PyPI
           uses: pypa/gh-action-pypi-publish@release/v1
           with:
-            user: __token__
-            password: ${{ secrets.PYPI }}
             skip-existing: true
diff --git a/changelog_entry.yaml b/changelog_entry.yaml
index e69de29..b7c1ccc 100644
--- a/changelog_entry.yaml
+++ b/changelog_entry.yaml
@@ -0,0 +1,4 @@
+- bump: patch
+  changes:
+    changed:
+    - Publish to PyPI with trusted publishing (OIDC) instead of a stored API token.