diff --git a/.github/workflows/rtc-tools.yml b/.github/workflows/rtc-tools.yml
index 6248bf6..b116d73 100644
--- a/.github/workflows/rtc-tools.yml
+++ b/.github/workflows/rtc-tools.yml
@@ -99,6 +99,9 @@ jobs:
     needs: [test-linux, examples-linux]
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')  }}
+    permissions:
+      id-token: write  # Required for OIDC PyPI publishing
+      contents: read
     steps:
       - name: Check out code
         uses: actions/checkout@v4
@@ -111,18 +114,10 @@ jobs:
       - name: Install build dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install build twine
+          pip install build
 
       - name: Build package
         run: python -m build
 
-      - name: Publish package to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-        run: |
-          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
-            twine upload dist/*
-          else
-            twine upload --repository-url https://test.pypi.org/legacy/ dist/*
-          fi
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1