diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ee8c9e122..095c19dc5 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,4 +1,4 @@
-name: Publish Python Package
+name: Publish Python 🐍 distribution 📦 to PyPI
 
 on:
   push:
@@ -16,24 +16,46 @@ jobs:
 
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: "3.8"
+          python-version: "3.10"
 
       - name: Install build dependencies
         run: |
           python -m pip install --upgrade pip
           pip install build setuptools-scm
-          pip install twine
 
       - name: Build source distribution (sdist only)
         run: python -m build --sdist
 
-      # We publish using the "Trusted Publisher" system on PyPi
-      - name: Publish to PyPI via OIDC
-        uses: pypa/gh-action-pypi-publish@v1.6.0
+      - name: Store the distribution packages
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
+  publish-to-pypi:
+    name: >-
+      Publish Python 🐍 distribution 📦 to PyPI
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi-deployment
+      url: https://pypi.org/p/cosmos-synthesizer
+    permissions:
+      id-token: write 
+
+    steps:
+      - name: Download all the dists
+        uses: actions/download-artifact@v4
         with:
-          user: __token__
+          name: python-package-distributions
+          path: dist/
+      - name: Publish distribution 📦 to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1