diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index 01f53de..1d6f4c0 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -14,6 +14,10 @@ on:
 
 permissions:
   contents: write
+  # Lets the runner mint the short-lived OIDC token that PyPI trusted publishing
+  # exchanges for an upload token. Without it the publish step has no credential
+  # at all, now that no API token is stored.
+  id-token: write
 
 jobs:
   deploy:
@@ -82,10 +86,10 @@ jobs:
       run: git fetch
     - name: push code to main
       run: git push
+    # No password: the action falls back to trusted publishing, authenticating as
+    # this workflow in this repository against the publisher configured on PyPI.
     - name: Publish to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        password: ${{ secrets.PYPI_API_TOKEN }}
     # Tag and release only once PyPI has accepted the upload. A version cannot be
     # re-uploaded to PyPI even after deletion, so the release must not advertise a
     # version that never made it there.