diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5701273..2f8c646 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -93,7 +93,7 @@ jobs:
 
       - uses: actions/upload-artifact@v4
         with:
-          name: pypi-dist
+          name: dist
           path: sdk/python/dist/*
 
   rust-package:
@@ -115,30 +115,21 @@ jobs:
   publish-pypi:
     runs-on: ubuntu-latest
     needs: python-build
-    if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && secrets.PYPI_API_TOKEN != '' }}
+    if: ${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, 'rc') && !contains(github.ref_name, 'a') && !contains(github.ref_name, 'b') }}
     permissions:
       id-token: write
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-python@v5
+      - uses: actions/download-artifact@v4
         with:
-          python-version: "3.11"
-
-      - name: Build wheel + sdist
-        working-directory: sdk/python
-        run: |
-          set -euxo pipefail
-          python -m pip install --upgrade pip build
-          python -m build
+          name: dist
+          path: dist
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
-          packages-dir: sdk/python/dist
+          packages-dir: dist
+          skip-existing: true
 
   publish-crates:
     runs-on: ubuntu-latest