diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 57183ca4..8ed54355 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -53,6 +53,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    permissions:
+      id-token: write
+      attestations: write
 
     strategy:
       matrix:
@@ -80,6 +83,5 @@ jobs:
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
-          skip_existing: true
+          attestations: true
+          skip-existing: true
diff --git a/AGENTS.md b/AGENTS.md
index 17803836..b795b92d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -126,7 +126,7 @@ Example format:
 
 ### Imports
 
-- Use namespace imports: `import enum` instead of `from enum import Enum`
+- Use namespace imports for stdlib: `import enum` instead of `from enum import Enum`; third-party packages may use `from X import Y`
 - For typing, use `import typing as t` and access via namespace: `t.NamedTuple`, etc.
 - Use `from __future__ import annotations` at the top of all Python files
 
diff --git a/CHANGES b/CHANGES
index b722b0fc..7f12185e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -31,6 +31,10 @@ $ uvx --from 'vcspull' --prerelease allow vcspull
 
 <!-- Maintainers, insert changes / features for the next release here -->
 
+### CI
+
+- Migrate to PyPI Trusted Publisher (#492)
+
 ## vcspull v1.48.1 (2025-12-06)
 
 ### Breaking changes