diff --git a/.github/workflows/dissect-ci.yml b/.github/workflows/dissect-ci.yml
index 2926533..e742f8f 100644
--- a/.github/workflows/dissect-ci.yml
+++ b/.github/workflows/dissect-ci.yml
@@ -4,6 +4,26 @@ on: [push, pull_request, workflow_dispatch]
 jobs: 
   ci:
     uses: fox-it/dissect-workflow-templates/.github/workflows/dissect-ci-template.yml@main
+    secrets: inherit
+
+  publish:
+    if: ${{ github.ref_name == 'main' || github.ref_type == 'tag' }}
+    needs: [ci]
+    runs-on: ubuntu-latest
+    environment: dissect_publish
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: packages
+          path: dist/
+      # According to the documentation, it automatically looks inside the `dist/` folder for packages.
+      - name: Publish package distributions to Pypi
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  trigger-tests:
+    needs: [publish]
+    uses: fox-it/dissect-workflow-templates/.github/workflows/dissect-ci-demand-test-template.yml@main
     with:
       on-demand-test: 'dissect.target'
-    secrets: inherit