diff --git a/.github/workflows/check-and-publish.yaml b/.github/workflows/check-and-publish.yaml
index 11413c4..87cd1e0 100644
--- a/.github/workflows/check-and-publish.yaml
+++ b/.github/workflows/check-and-publish.yaml
@@ -38,8 +38,8 @@ jobs:
           name: dist
           path: dist
 
-  publish:
-    name: Publish
+  publish-test:
+    name: Publish to test.pypi.org
     if: ${{ github.event_name == 'push' && vars.PUBLISH_PYPI == 'true' && (startsWith(github.ref, 'refs/tags') || github.ref == 'refs/heads/master') }}
     runs-on: ubuntu-latest
     needs:
@@ -59,6 +59,26 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           repository-url: https://test.pypi.org/legacy/
+
+  publish-production:
+    name: Publish
+    if: ${{ github.event_name == 'push' && vars.PUBLISH_PYPI == 'true' && startsWith(github.ref, 'refs/tags') }}
+    runs-on: ubuntu-latest
+    needs:
+      - codespell
+      - pytest
+      - ruff
+      - build
+      - publish-test
+    permissions:
+      id-token: write
+    steps:
+      - name: Download artifacts from build stage
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
       - name: Publish distribution package to PyPI
-        if: ${{ startsWith(github.ref, 'refs/tags') }}
         uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: false