diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1f4a33a..042c6ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,6 +29,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - `publish-pypi` checks the dist with `uvx twine` instead of `uv pip install --system twine`, which fails on PEP 668 externally-managed CPython from `setup-uv`.
 - `publish-pypi` uploads with `uv publish` instead of `pypa/gh-action-pypi-publish`. Nested Docker actions resolve to `ghcr.io/qntx/workflows:<sha>` and 403.
+- `publish-pypi` does not export empty `UV_PUBLISH_URL`; uv treats `''` as an invalid `--publish-url`.
 
 ### Added
 
diff --git a/actions/publish-pypi/action.yml b/actions/publish-pypi/action.yml
index 39a981a..da043f1 100644
--- a/actions/publish-pypi/action.yml
+++ b/actions/publish-pypi/action.yml
@@ -39,16 +39,16 @@ runs:
       working-directory: ${{ inputs.working-directory }}
       env:
         UV_PUBLISH_TOKEN: ${{ env.PYPI_TOKEN }}
-        UV_PUBLISH_URL: ${{ inputs.repository-url }}
         ATTESTATIONS: ${{ inputs.attestations }}
+        REPOSITORY_URL: ${{ inputs.repository-url }}
       run: |
         set -euo pipefail
         extra=()
         if [ -z "${UV_PUBLISH_TOKEN:-}" ]; then
           extra+=(--trusted-publishing always)
         fi
-        if [ -n "${UV_PUBLISH_URL:-}" ]; then
-          extra+=(--publish-url "$UV_PUBLISH_URL")
+        if [ -n "${REPOSITORY_URL:-}" ]; then
+          extra+=(--publish-url "$REPOSITORY_URL")
         fi
         if [ "${ATTESTATIONS}" != "true" ]; then
           extra+=(--no-attestations)