diff --git a/.github/workflows/sdk_generation.yaml b/.github/workflows/sdk_generation.yaml
index eb84bcf4..dfb21c54 100644
--- a/.github/workflows/sdk_generation.yaml
+++ b/.github/workflows/sdk_generation.yaml
@@ -35,7 +35,6 @@ jobs:
       set_version: ${{ github.event.inputs.set_version }}
     secrets:
       github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
       speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
 
   resolve-branch:
diff --git a/.github/workflows/sdk_generation_for_spec_change.yaml b/.github/workflows/sdk_generation_for_spec_change.yaml
index 5ab18075..0fdc5777 100644
--- a/.github/workflows/sdk_generation_for_spec_change.yaml
+++ b/.github/workflows/sdk_generation_for_spec_change.yaml
@@ -36,7 +36,6 @@ jobs:
       set_version: ${{ github.event.inputs.set_version }}
     secrets:
       github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
       speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
 
   resolve-branch:
diff --git a/.github/workflows/sdk_publish.yaml b/.github/workflows/sdk_publish.yaml
index 5a2a0339..f54fadf6 100644
--- a/.github/workflows/sdk_publish.yaml
+++ b/.github/workflows/sdk_publish.yaml
@@ -1,10 +1,5 @@
 name: Publish
-permissions:
-  checks: write
-  contents: write
-  pull-requests: write
-  statuses: write
-  id-token: write
+permissions: {}
 "on":
   push:
     branches:
@@ -14,10 +9,32 @@ permissions:
   workflow_dispatch: {}
 jobs:
   publish:
+    permissions:
+      checks: write
+      contents: write
+      pull-requests: write
+      statuses: write
+      id-token: write
     uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@68f3bfefb79354d39358bf4699863dabd2cea0f6 # v15.60.11
     with:
       target: open-router
     secrets:
       github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      pypi_token: ${{ secrets.PYPI_TOKEN }}
       speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
+  # The reusable workflow skips its token-based PyPI job when useTrustedPublishing is set; this job uploads through OIDC instead.
+  publish-pypi:
+    needs: publish
+    if: ${{ needs.publish.outputs.python_regenerated == 'true' && needs.publish.outputs.publish_python == 'true' && needs.publish.outputs.use_pypi_trusted_publishing == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: speakeasy-api/sdk-generation-action/publish-pypi@68f3bfefb79354d39358bf4699863dabd2cea0f6 # v15.60.11
+        with:
+          python-directory: ${{ needs.publish.outputs.python_directory }}
+          speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.speakeasy/workflow.yaml b/.speakeasy/workflow.yaml
index dee12e9a..d523a677 100644
--- a/.speakeasy/workflow.yaml
+++ b/.speakeasy/workflow.yaml
@@ -22,7 +22,7 @@ targets:
         source: OpenRouter API
         publish:
             pypi:
-                token: $pypi_token
+                useTrustedPublishing: true
         codeSamples:
             registry:
                 location: registry.speakeasyapi.dev/openrouter/sdk/open-router-python-code-samples