diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 69f7d7b..f1d0bb7 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -1,13 +1,16 @@
 name: python
 
 # Build abi3 wheels (linux + macos, py3.9+) and an sdist for crates/tare-py, then
-# (on a version tag, if PYPI_TOKEN is set) publish to PyPI. Triggered by a version
+# (on a version tag) publish to PyPI. Triggered by a version
 # tag, or manually via workflow_dispatch to rebuild/re-publish.
 on:
   push:
     tags: ["v[0-9]+.[0-9]+.[0-9]+*"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build-wheels:
     name: build wheel (${{ matrix.os }}, ${{ matrix.target }})
@@ -23,14 +26,14 @@ jobs:
             target: x86_64-apple-darwin
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: PyO3/maturin-action@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
         with:
           target: ${{ matrix.target }}
           manylinux: auto
           args: --release --out dist -m crates/tare-py/Cargo.toml
           sccache: 'true'
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: wheels-${{ matrix.os }}-${{ matrix.target }}
           path: dist
@@ -39,12 +42,12 @@ jobs:
     name: build sdist
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: PyO3/maturin-action@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
         with:
           command: sdist
           args: --out dist -m crates/tare-py/Cargo.toml
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: sdist
           path: dist
@@ -53,24 +56,21 @@ jobs:
     name: publish to PyPI
     needs: [build-wheels, build-sdist]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: "wheels-*"
           merge-multiple: true
           path: dist
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: sdist
           path: dist
-      - name: Publish to PyPI (needs PYPI_TOKEN; idempotent)
-        env:
-          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
-        shell: bash
-        run: |
-          if [ -z "${MATURIN_PYPI_TOKEN:-}" ]; then
-            echo "PYPI_TOKEN secret not set — skipping PyPI publish."
-            exit 0
-          fi
-          pip install maturin
-          maturin upload --skip-existing dist/*
+      - name: Publish to PyPI (idempotent)
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          packages-dir: dist/
+          skip-existing: true