diff --git a/.github/workflows/versioning.yaml b/.github/workflows/versioning.yaml
index 0ca75d39..2b2af1bc 100644
--- a/.github/workflows/versioning.yaml
+++ b/.github/workflows/versioning.yaml
@@ -49,6 +49,9 @@ jobs:
       name: Publish to PyPI
       if: (github.event.head_commit.message == 'Update package version')
       runs-on: ubuntu-latest
+      # PyPI trusted publishing: uploads accepted only from this workflow in
+      # the pypi environment (limited to main). No stored token.
+      environment: pypi
       permissions:
         contents: write
         id-token: write
@@ -74,8 +77,6 @@ jobs:
         - name: Publish to PyPI
           uses: pypa/gh-action-pypi-publish@release/v1
           with:
-            user: __token__
-            password: ${{ secrets.PYPI }}
             skip-existing: true
         # After the upload, so a tag failure can never hold back a release.
         # skip-existing above keeps a rerun safe.
diff --git a/changelog.d/trusted-publishing.changed.md b/changelog.d/trusted-publishing.changed.md
new file mode 100644
index 00000000..616c4aeb
--- /dev/null
+++ b/changelog.d/trusted-publishing.changed.md
@@ -0,0 +1 @@
+Publish to PyPI with trusted publishing (OIDC) instead of a stored API token.