diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64e4f541..b82bf6de 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,6 +41,8 @@ jobs:
     defaults:
       run:
         working-directory: python
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
@@ -58,8 +60,6 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' }}
         with:
-          user: __token__
-          password: ${{ secrets.TESTPYPI_API_TOKEN }}
           packages_dir: python/dist
           repository_url: https://test.pypi.org/legacy/
           skip_existing: true
@@ -68,8 +68,6 @@ jobs:
         if: ${{ startsWith(github.ref, 'refs/tags/releases/python/v') }}
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
           packages_dir: python/dist
 
   cpp: