diff --git a/.github/workflows/test_and_deploy.yml b/.github/workflows/test_and_deploy.yml
index 2812c2abb..9ecdad21a 100644
--- a/.github/workflows/test_and_deploy.yml
+++ b/.github/workflows/test_and_deploy.yml
@@ -116,6 +116,11 @@ jobs:
     needs: test_sdist
     if: github.event_name == 'release' && github.event.action == 'released'
     runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/p/nle
+    permissions:
+      id-token: write
     steps:
     - uses: actions/checkout@v2
     - name: Check version matches release tag
@@ -138,7 +143,4 @@ jobs:
     # NOTE: we assume that dist/ contains a built sdist (and only that).
     #       Yes, we could be more defensively, but What Could Go Wrong?™
     - name: Publish package to PyPI
-      uses: pypa/gh-action-pypi-publish@master
-      with:
-        user: __token__
-        password: ${{ secrets.PYPI_TOKEN }}
+      uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/version.txt b/version.txt
index ac39a106c..f374f6662 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-0.9.0
+0.9.1