diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 14636c54..cc5fc7fe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -82,6 +82,11 @@ jobs:
       - docs
       - test
     runs-on: ubuntu-latest
+    environment:
+      name: publish-to-pypi
+      url: https://pypi.org/p/ufoLib2
+    permissions:
+      id-token: write # IMPORTANT: mandatory for trusted publishing.
 
     steps:
       - uses: actions/checkout@v4
@@ -89,14 +94,7 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: "3.x"
-      - name: Install dependencies
-        run: |
-          pip install build twine
-      - name: Build and publish
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        run: |
-          python -m build
-          twine check dist/*
-          twine upload dist/*
+      - name: Build
+        run: pipx run build
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@v1.13.0