diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ba48626..dc470e4 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -93,18 +93,15 @@ jobs:
       name: pypi-nightly
       url: https://pypi.org/p/coreai-opt-nightly
     permissions:
-      id-token: write # mint the OIDC token PyPI validates for Trusted Publishing
+      id-token: write # mint the OIDC token for Trusted Publishing and attestation signing
       contents: read
     steps:
-      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-        with:
-          enable-cache: false
       - name: Download wheel
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: nightly-wheel
           path: dist/
       - name: Publish to PyPI
-        # `always` requires Trusted Publishing (OIDC) — no fallback to tokens.
-        run: uv publish --trusted-publishing always
+        # Uploads via Trusted Publishing and signs a PEP 740 attestation for each
+        # file with this workflow's OIDC identity, so PyPI shows its provenance.
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9edff75..d1af138 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -137,18 +137,15 @@ jobs:
       name: pypi
       url: https://pypi.org/p/coreai-opt
     permissions:
-      id-token: write # mint the OIDC token PyPI validates for Trusted Publishing
+      id-token: write # mint the OIDC token for Trusted Publishing and attestation signing
       contents: read
     steps:
-      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-        with:
-          enable-cache: false
       - name: Download distributions
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
       - name: Publish to PyPI
-        # `always` requires Trusted Publishing (OIDC) — no fallback to tokens.
-        run: uv publish --trusted-publishing always
+        # Uploads via Trusted Publishing and signs a PEP 740 attestation for each
+        # file with this workflow's OIDC identity, so PyPI shows its provenance.
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3