diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index e83a537..dd2415e 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -12,6 +12,7 @@ permissions:
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    environment: pypi
     permissions:
       # Required for PyPI Trusted Publishing (OIDC) — lets GitHub publish without
       # any stored PyPI password or API token.