diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..fb242cc
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,71 @@
+name: Build package
+
+on:
+  push:
+  pull_request:
+  release:
+    types:
+      - published
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  # Always build & lint package.
+  build-package:
+    name: Build & verify package
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hynek/build-and-inspect-python-package@v1
+
+  # Publish to Test PyPI on every commit on main.
+  release-test-pypi:
+    name: Publish in-dev package to test.pypi.org
+    if: |
+      github.repository_owner == 'python'
+      && github.event_name == 'push'
+      && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    needs: build-package
+
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v3
+        with:
+          name: Packages
+          path: dist
+
+      - name: Publish to Test PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  # Publish to PyPI on GitHub Releases.
+  release-pypi:
+    name: Publish to PyPI
+    # Only run for published releases.
+    if: |
+      github.repository_owner == 'python'
+      && github.event.action == 'published'
+    runs-on: ubuntu-latest
+    needs: build-package
+
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v3
+        with:
+          name: Packages
+          path: dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/cherry_picker/__init__.py b/cherry_picker/__init__.py
index 5636972..b654ebc 100644
--- a/cherry_picker/__init__.py
+++ b/cherry_picker/__init__.py
@@ -1,2 +1,4 @@
 """Backport CPython changes from main to maintenance branches."""
-__version__ = "2.2.0"
+import importlib.metadata
+
+__version__ = importlib.metadata.version(__name__)
diff --git a/pyproject.toml b/pyproject.toml
index e47b7eb..1fc22dc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,34 +1,48 @@
 [build-system]
-requires = ["flit_core>=3.2,<4"]
-build-backend = "flit_core.buildapi"
+build-backend = "hatchling.build"
+requires = [
+  "hatch-vcs",
+  "hatchling",
+]
 
 [project]
-name = "cherry_picker"
-authors = [{ name = "Mariatta Wijaya", email = "mariatta@python.org" }]
+name = "cherry-picker"
+readme = "readme.rst"
 maintainers = [{ name = "Python Core Developers", email = "core-workflow@python.org" }]
+authors = [{ name = "Mariatta Wijaya", email = "mariatta@python.org" }]
+requires-python = ">=3.8"
+classifiers = [
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: Apache Software License",
+  "Programming Language :: Python :: 3 :: Only",
+  "Programming Language :: Python :: 3.8",
+  "Programming Language :: Python :: 3.9",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+]
+dynamic = [
+  "description",
+  "version",
+]
 dependencies = [
-    "click>=6.0",
-    "gidgethub",
-    "requests",
-    "tomli>=1.1.0;python_version<'3.11'",
+  "click>=6",
+  "gidgethub",
+  "requests",
+  'tomli>=1.1; python_version < "3.11"',
 ]
-readme = "readme.rst"
-classifiers = [
-    "Programming Language :: Python :: 3.8",
-    "Intended Audience :: Developers",
-    "License :: OSI Approved :: Apache Software License",
+[project.optional-dependencies]
+dev = [
+  "pytest",
+  "pytest-cov",
 ]
-requires-python = ">=3.8"
-dynamic = ["version", "description"]
-
 [project.urls]
 "Homepage" = "https://github.com/python/cherry-picker"
-
 [project.scripts]
 cherry_picker = "cherry_picker.cherry_picker:cherry_pick_cli"
 
-[project.optional-dependencies]
-dev = [
-    "pytest",
-    "pytest-cov",
-]
+[tool.hatch]
+version.source = "vcs"
+
+[tool.hatch.version.raw-options]
+local_scheme = "no-local-version"