diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1c5ee6d..4182b6e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,4 +1,4 @@
-name: Publish package to PyPi
+name: Publish package to PyPI
 
 on:
   push:
@@ -6,17 +6,20 @@ on:
       - '*'
 
 jobs:
+  publish:
+    runs-on: ubuntu-22.04
 
-  push:
-    runs-on: ubuntu-20.04
+    environment:
+      name: pypi
+      url: https://pypi.org/p/edx-arch-experiments
+    permissions:
+      id-token: write  # used by pypi-publish
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: setup python
-        uses: actions/setup-python@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v4
         with:
-          python-version: 3.11
+          python-version: '3.11'
 
       - name: Install pip
         run: pip install -r requirements/pip.txt
@@ -24,8 +27,5 @@ jobs:
       - name: Build package
         run: python setup.py sdist bdist_wheel
 
-      - name: Publish to PyPi
+      - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_UPLOAD_TOKEN }}
diff --git a/.github/workflows/test_publish.yml b/.github/workflows/test_publish.yml
index c2837c3..788a3d0 100644
--- a/.github/workflows/test_publish.yml
+++ b/.github/workflows/test_publish.yml
@@ -1,26 +1,33 @@
-name: Test Publish
+name: Test-publish package to PyPI
 
 on:
   pull_request:
 
 jobs:
-  testing:
-    runs-on: ubuntu-latest
+  test-publish:
+    runs-on: ubuntu-22.04
+
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/edx-arch-experiments
+    permissions:
+      id-token: write  # used by pypi-publish
+
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
         with:
           python-version: '3.11'
-          architecture: x64
+
       - name: Install pip
         run: pip install -r requirements/pip.txt
+
       - name: Build package
         run: python setup.py sdist bdist_wheel
-      - name: Test publish
+
+      - name: Publish to PyPI (test server)
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.PYPI_TEST_UPLOAD_TOKEN }}
           repository_url: https://test.pypi.org/legacy/
           skip_existing: true