diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000000..4997b1f675
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,44 @@
+on:
+  push:
+    tags:
+      - v*
+
+# a lot of code taken from https://github.com/pypa/cibuildwheel/blob/main/examples/github-deploy.yml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.8"
+      - run: python -m pip install build
+      - run: python -m build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: trio-dist
+          path: |
+            dist/*.tar.gz
+            dist/*.whl
+
+  pypi-publish:
+    needs: [build]
+    name: upload release to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/project/trio
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: trio-*
+          path: dist
+          merge-multiple: true
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/docs/source/releasing.rst b/docs/source/releasing.rst
index 4b530d7de3..3adc7b17b0 100644
--- a/docs/source/releasing.rst
+++ b/docs/source/releasing.rst
@@ -41,13 +41,7 @@ Things to do for releasing:
 
 * tag with vVERSION, push tag on ``python-trio/trio`` (not on your personal repository)
 
-* push to PyPI:
-
-  .. code-block::
-
-    git clean -xdf   # maybe run 'git clean -xdn' first to see what it will delete
-    python3 -m build
-    twine upload dist/*
+* approve the release workflow's publish job
 
 * update version number in the same pull request
 
diff --git a/newsfragments/2980.misc.rst b/newsfragments/2980.misc.rst
new file mode 100644
index 0000000000..ada9c20e45
--- /dev/null
+++ b/newsfragments/2980.misc.rst
@@ -0,0 +1 @@
+Use PyPI's Trusted Publishers to make releases.