diff --git a/.github/workflows/main.yml b/.github/workflows/ci.yml
similarity index 80%
rename from .github/workflows/main.yml
rename to .github/workflows/ci.yml
index 68f1566..dcaf73e 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/ci.yml
@@ -1,9 +1,12 @@
-name: build
+name: CI
 
 on: [push, pull_request]
 
 env:
-  PYTEST_ADDOPTS: "--color=yes"
+  FORCE_COLOR: "1" # Make tools pretty.
+  TOX_TESTENV_PASSENV: FORCE_COLOR
+  PIP_DISABLE_PIP_VERSION_CHECK: "1"
+  PIP_NO_PYTHON_VERSION_WARNING: "1"
 
 jobs:
   test:
@@ -101,35 +104,36 @@ jobs:
       - name: Run linters
         run: poetry run invoke lint
 
-
-  deploy:
-    name: Deploy
+  prep-release:
+    name: Release preparations
     environment: Deployment
     needs: [test, lint]
     runs-on: ubuntu-latest
     if: ${{ github.ref=='refs/heads/main' && github.event_name!='pull_request' }}
+    permissions:
+      contents: write
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.GH_TOKEN }}
       - name: Setup Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v4
         with:
-          python-version: "3.8"
+          python-version: "3.10"
       - name: Check release
         id: check_release
         run: |
           python -m pip install --upgrade pip
-          python -m pip install poetry githubrelease httpx==0.16.1 autopub
-          echo "##[set-output name=release;]$(autopub check)"
-      - name: Publish
+          python -m pip install poetry autopub[github]
+          echo "release=$(autopub check)" >> "$GITHUB_OUTPUT"
+          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+          echo "release<<$EOF" >> "$GITHUB_OUTPUT"
+          autopub check >> "$GITHUB_OUTPUT"
+          echo "$EOF" >> "$GITHUB_OUTPUT"
+      - name: Tag & Create GH release
         if: ${{ steps.check_release.outputs.release=='' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
-          PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
         run: |
-          git remote set-url origin https://$GITHUB_TOKEN@github.com/${{ github.repository }}
           autopub prepare
-          poetry build
+          autopub build
           autopub commit
-          autopub githubrelease
-          poetry publish -u __token__ -p $PYPI_PASSWORD
diff --git a/.github/workflows/pypi-package.yml b/.github/workflows/pypi-package.yml
new file mode 100644
index 0000000..2029eb6
--- /dev/null
+++ b/.github/workflows/pypi-package.yml
@@ -0,0 +1,50 @@
+---
+name: Build & upload PyPI package
+
+on:
+  push:
+    tags: ["*"]
+
+jobs:
+  build-package:
+    name: Build & verify package
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - uses: hynek/build-and-inspect-python-package@v1
+
+  release-pypi:
+    name: Publish released package to pypi.org
+    environment: Deployment
+    runs-on: ubuntu-latest
+    needs: build-package
+    permissions:
+      id-token: write
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup Python
+        uses: actions/setup-python@v4
+
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v3
+        with:
+          name: Packages
+          path: dist
+
+      - name: Upload package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/ # TODO: Move over to actual PyPI
+
+      - name: Create Github release
+        run: |
+          pip install autopub[github]
+          autopub githubrelease
diff --git a/pyproject.toml b/pyproject.toml
index db31520..e196daa 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -20,12 +20,6 @@ classifiers = [
     "Intended Audience :: Developers",
     "License :: OSI Approved :: BSD License",
     "Operating System :: OS Independent",
-    "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.7",
-    "Programming Language :: Python :: 3.8",
-    "Programming Language :: Python :: 3.9",
-    "Programming Language :: Python :: 3.10",
-    "Programming Language :: Python :: 3.11",
     "Topic :: Security",
     "Topic :: Security :: Cryptography",
     "Topic :: Software Development :: Libraries :: Python Modules",
@@ -60,6 +54,7 @@ Werkzeug = "^2.0"
 
 [tool.autopub]
 project-name = "Kagi"
+build-system = "poetry"
 git-username = "botpub"
 git-email = "botpub@autopub.rocks"
 append-github-contributor = true
@@ -92,3 +87,6 @@ DJANGO_SETTINGS_MODULE = 'testproj.settings'
 [tool.flake8]
 ignore = ['E203', 'E501', 'W503']
 max-line-length = 88
+
+[tool.check-wheel-contents]
+ignore = ['W004']