diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index f02018d..a5eca9d 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -67,6 +67,12 @@ jobs:
       - uses: codecov/codecov-action@v6
   Publish:
     runs-on: ubuntu-latest
+    # PyPI trusted publishing: uploads accepted only from this workflow in the
+    # pypi environment (limited to master). No stored token.
+    environment: pypi
+    permissions:
+      contents: write  # publish-git-tag.sh pushes the version tag
+      id-token: write
     if: |
       (github.repository == 'PolicyEngine/policyengine-ng')
       && (github.event.head_commit.message == 'Update PolicyEngine Nigeria')
@@ -86,8 +92,6 @@ jobs:
       - name: Publish a Python distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.PYPI }}
           skip_existing: true
   Deploy:
     if: |
diff --git a/changelog.d/changed/migrate-to-app-token.md b/changelog.d/migrate-to-app-token.changed.md
similarity index 100%
rename from changelog.d/changed/migrate-to-app-token.md
rename to changelog.d/migrate-to-app-token.changed.md
diff --git a/changelog.d/trusted-publishing.changed.md b/changelog.d/trusted-publishing.changed.md
new file mode 100644
index 0000000..01577bf
--- /dev/null
+++ b/changelog.d/trusted-publishing.changed.md
@@ -0,0 +1 @@
+Publish to PyPI with trusted publishing (OIDC) from the `pypi` environment instead of a stored API token.
diff --git a/pyproject.toml b/pyproject.toml
index b3d6a86..011c2a1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "policyengine-ng"
-version = "0.5.4"
+version = "0.6.0"
 description = "Core microsimulation engine enabling country-specific policy models."
 readme = "README.md"
 authors = [