diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 17876e2..98ebbe2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -46,12 +46,37 @@ jobs:
         name: python-package-distributions
         path: dist/
 
+  publish-to-pypi:
+    name: >-
+      Publish Python 🐍 distribution 📦 to PyPI
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: startsWith(github.ref, 'refs/tags/')  # only publish to PyPI on tag pushes
+
+    environment:
+      name: pypi
+      url: https://pypi.org/p/celery-redbeat
+
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution 📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+
   github-release:
     name: >-
       Sign the Python 🐍 distribution 📦 with Sigstore
       and upload them to GitHub Release
     needs:
-    - build
+    - publish-to-pypi
     runs-on: ubuntu-latest
     timeout-minutes: 10
     if: startsWith(github.ref, 'refs/tags/')
@@ -90,3 +115,44 @@ jobs:
         gh release upload
         "$GITHUB_REF_NAME" dist/**
         --repo "$GITHUB_REPOSITORY"
+
+  publish-to-testpypi:
+    name: Publish Python 🐍 distribution 📦 to TestPyPI
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/celery-redbeat
+
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+
+    steps:
+    # Rebuild rather than reuse the build job's artifact: pbr derives the
+    # version from git tags (X.Y.Z on a tag, X.Y.(Z+1).devN between tags), so
+    # this needs full history, not the shallow default, to see prior tags.
+    - name: Check out source code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+        persist-credentials: false
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+        cache: pip
+    - name: Install build tooling
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install build
+    - name: Build a binary wheel and a source tarball
+      run: python -m build
+    - name: Publish distribution 📦 to TestPyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        verbose: true
+        skip-existing: true
+        repository-url: https://test.pypi.org/legacy/
diff --git a/CHANGES.txt b/CHANGES.txt
index 5dd372d..12605c0 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,5 +1,9 @@
-2.4.1dev (unreleased)
+2.4.1 (unreleased)
 ---------------------
+  - ci, restore PyPI/TestPyPI publish jobs dropped in a CI refactor; 2.3.4 and
+    2.4.0 were tagged but never published to PyPI, fixes #316
+  - First PyPI release since 2.3.3; includes all 2.4.0 changes below
+
 2.4.0 (2026-03-26)
 ---------------------
   - Drop support for Python 3.8 and add CI coverage through Python 3.13.
diff --git a/makefile b/makefile
index e205da3..b177926 100644
--- a/makefile
+++ b/makefile
@@ -31,9 +31,8 @@ release-tag:
 ifndef VERSION
 	@echo "usage: make release VERSION='M.m.p'" && false
 else
-	sed -i '' -e 's|version = .*|version = $(VERSION)|' setup.cfg
 	sed -i '' -e "s/unreleased/$(TODAY)/" CHANGES.txt
-	git ci -m"prepare for release of $(VERSION)" CHANGES.txt setup.cfg || git commit -m"prepare for release of $(VERSION)" CHANGES.txt setup.cfg || true
+	git ci -m"prepare for release of $(VERSION)" CHANGES.txt || git commit -m"prepare for release of $(VERSION)" CHANGES.txt || true
 	git tag -a v$(VERSION) -m"release version $(VERSION)"
 	git push --tags
 	printf "%s\n%s\n%s\n  -\n" "$(NEXT_VERSION)dev (unreleased)" "---------------------" "$$(cat CHANGES.txt)" > CHANGES.txt
@@ -57,4 +56,4 @@ clean-venv:
 	rm -rf .venv
 
 version:
-	@grep -m1 '^version' setup.cfg | sed 's/.*= *//'
+	@python setup.py --version
diff --git a/setup.cfg b/setup.cfg
index 6b19e51..994763b 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,7 +1,6 @@
 [metadata]
 name = celery-redbeat
 description = A Celery Beat Scheduler using Redis for persistent storage
-version = 2.4.0
 license = Apache License, Version 2.0
 
 author = Marc Sibson
@@ -44,6 +43,3 @@ universal = 1
 
 [tool:pytest]
 # ... if you use pytest ...
-
-[pbr]
-version = 2.4.0