diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index 4b25af3c2..4ee611dd6 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -89,6 +89,12 @@ jobs:
           FOLDER: docs/_build/html  # The folder the action should deploy.
   Publish:
     runs-on: ubuntu-latest
+    # PyPI trusted publishing: uploads accepted only from this workflow in the
+    # pypi environment (limited to master). No stored token.
+    environment: pypi
+    permissions:
+      contents: write  # publish-git-tag.sh pushes the version tag
+      id-token: write
     if: |
       (github.repository == 'PolicyEngine/policyengine-canada')
       && (github.event.head_commit.message == 'Update PolicyEngine Canada')
@@ -111,8 +117,6 @@ jobs:
       - name: Publish a Python distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.PYPI }}
           skip_existing: true
   Deploy:
     if: |
diff --git a/changelog.d/fixed/fix-climate-action-category.md b/changelog.d/fix-climate-action-category.fixed.md
similarity index 100%
rename from changelog.d/fixed/fix-climate-action-category.md
rename to changelog.d/fix-climate-action-category.fixed.md
diff --git a/changelog.d/fixed/migrate-to-app-token.md b/changelog.d/migrate-to-app-token.fixed.md
similarity index 100%
rename from changelog.d/fixed/migrate-to-app-token.md
rename to changelog.d/migrate-to-app-token.fixed.md
diff --git a/changelog.d/trusted-publishing.changed.md b/changelog.d/trusted-publishing.changed.md
new file mode 100644
index 000000000..01577bf04
--- /dev/null
+++ b/changelog.d/trusted-publishing.changed.md
@@ -0,0 +1 @@
+Publish to PyPI with trusted publishing (OIDC) from the `pypi` environment instead of a stored API token.