diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index 0f85b21..e5258b2 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -76,6 +76,12 @@ jobs:
           FOLDER: docs/_build/html
   Publish:
     runs-on: ubuntu-latest
+    # PyPI trusted publishing: uploads accepted only from this workflow in the
+    # pypi environment (limited to master). No stored token.
+    environment: pypi
+    permissions:
+      contents: write  # publish-git-tag.sh pushes the version tag
+      id-token: write
     if: |
       (github.repository == 'PolicyEngine/policyengine-il')
       && (github.event.head_commit.message == 'Update PolicyEngine Israel')
@@ -95,8 +101,6 @@ jobs:
       - name: Publish a Python distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.PYPI }}
           skip_existing: true
   Deploy:
     if: |
diff --git a/changelog.d/trusted-publishing.changed.md b/changelog.d/trusted-publishing.changed.md
new file mode 100644
index 0000000..01577bf
--- /dev/null
+++ b/changelog.d/trusted-publishing.changed.md
@@ -0,0 +1 @@
+Publish to PyPI with trusted publishing (OIDC) from the `pypi` environment instead of a stored API token.
diff --git a/pyproject.toml b/pyproject.toml
index a9b8128..42ec42c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "policyengine-il"
-version = "0.1.5"
+version = "0.2.0"
 description = "Core microsimulation engine enabling country-specific policy models."
 readme = "README.md"
 authors = [