diff --git a/.github/workflows/pypi.yaml b/.github/workflows/pypi.yaml
index fca3184..ca4cea8 100644
--- a/.github/workflows/pypi.yaml
+++ b/.github/workflows/pypi.yaml
@@ -1,66 +1,84 @@
-name: Upload intake-thredds to PyPI
+name: Build and Upload intake-thredds to PyPI
 
 on:
   release:
     types:
       - published
-  workflow_dispatch:
+  push:
+
 jobs:
-  test-deploy:
-    if: github.repository == 'intake/intake-thredds'
+  build-artifacts:
     runs-on: ubuntu-latest
+    if: github.repository == 'intake/intake-thredds'
     steps:
       - uses: actions/checkout@v4
-      - name: Set up Python
-        uses: actions/setup-python@v5
         with:
-          python-version: "3.x"
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        name: Install Python
+        with:
+          python-version: "3.11"
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           python -m pip install setuptools setuptools-scm wheel twine check-manifest
+
       - name: Build tarball and wheels
         run: |
-          python setup.py sdist bdist_wheel
-          python -m pip wheel . -w dist --no-deps
-      - name: Test the artifacts
+          git clean -xdf
+          git restore -SW .
+          python -m build --sdist --wheel .
+
+      - name: Check built artifacts
         run: |
           python -m twine check dist/*
-
-      - name: Publish package to TestPyPI
-        uses: pypa/gh-action-pypi-publish@v1.8.12
+          pwd
+          if [ -f dist/intake-thredds-unknown.tar.gz ]; then
+            echo "❌ INVALID VERSION NUMBER"
+            exit 1
+          else
+            echo "✅ Looks good"
+          fi
+      - uses: actions/upload-artifact@v4
         with:
-          user: __token__
-          password: ${{ secrets.TESTPYPI_PASSWORD }}
-          repository-url: https://test.pypi.org/legacy/
-          verbose: true
+          name: releases
+          path: dist
 
-  deploy:
-    needs: test-deploy
-    if: startsWith(github.ref, 'refs/tags')
+  test-built-dist:
+    needs: build-artifacts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - uses: actions/setup-python@v5
+        name: Install Python
         with:
-          python-version: "3.x"
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install setuptools setuptools-scm wheel twine check-manifest
-      - name: Build tarball and wheels
+          python-version: "3.11"
+      - uses: actions/download-artifact@v4
+        with:
+          name: releases
+          path: dist
+      - name: List contents of built dist
         run: |
-          python setup.py sdist bdist_wheel
-          python -m pip wheel . -w dist --no-deps
-      - name: Test the artifacts
+          ls -ltrh
+          ls -ltrh dist
+
+      - name: Verify the built dist/wheel is valid
+        if: github.event_name == 'push'
         run: |
-          python -m twine check dist/*
+          python -m pip install --upgrade pip
+          python -m pip install dist/intake_thredds*.whl
+          python -c "import intake_thredds; print(intake_thredds.__version__)"
 
+  upload-to-pypi:
+    needs: test-built-dist
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: releases
+          path: dist
       - name: Publish package to PyPI
         uses: pypa/gh-action-pypi-publish@v1.8.12
-        with:
-          user: ${{ secrets.PYPI_USERNAME }}
-          password: ${{ secrets.PYPI_PASSWORD }}
-          skip-existing: true
-          verbose: true