diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 25cc188..245baf9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,12 +4,15 @@ name: release
 on:
   release:
     types: [published]
+  workflow_dispatch:
 
 jobs:
   pypi:
     name: Publish to PyPI registry
     environment: release
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
 
     env:
       FORCE_COLOR: 1
@@ -17,21 +20,24 @@ jobs:
       TOXENV: pkg
 
     steps:
-      - name: Switch to using Python 3.9 by default
+      - name: Switch to using Python 3.10 by default
         uses: actions/setup-python@v5
         with:
-          python-version: 3.9
+          python-version: "3.10"
+
       - name: Install tox
         run: python3 -m pip install --user "tox>=4.0.8"
+
       - name: Check out src from Git
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0 # needed by setuptools-scm
+          submodules: true
+
       - name: Build dists
         run: python -m tox
+
       - name: Publish to pypi.org
         if: >- # "create" workflows run separately from "push" & "pull_request"
           github.event_name == 'release'
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.pypi_password }}