diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8bdf732..a4d08a5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,6 +12,7 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-python@v7
diff --git a/docs/publishing.md b/docs/publishing.md
index 9afd191..f3752a0 100644
--- a/docs/publishing.md
+++ b/docs/publishing.md
@@ -11,11 +11,8 @@ No long-lived PyPI API token is stored in the repository.
    - Owner: `askmy-stack`
    - Repository: `tool-semantics`
    - Workflow: `publish.yml`
-   - Environment: leave blank
-
-The workflow intentionally has no GitHub Environment. If an environment is added
-later, add the same environment name to PyPI's trusted-publisher configuration
-first; otherwise PyPI will reject the environment-scoped OIDC identity.
+   - Environment: `pypi`
+3. In GitHub, create an Environment named `pypi` (optional protection rules).
 
 ## Release steps