diff --git a/.github/workflows/publish-main.yml b/.github/workflows/publish-main.yml
index 971b1231..6bd69d01 100644
--- a/.github/workflows/publish-main.yml
+++ b/.github/workflows/publish-main.yml
@@ -238,18 +238,27 @@ jobs:
     needs: [decide, build]
     if: needs.decide.outputs.release == 'true' && needs.decide.outputs.dry == 'false'
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
 
+      - name: Check the token is present
+        env:
+          PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "${PYPI_TOKEN:-}" ]; then
+            echo "::error::PYPI_TOKEN is not set on this repository; the upload would fail after the build."
+            exit 1
+          fi
+
       - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: dist/
           print-hash: true
+          password: ${{ secrets.PYPI_TOKEN }}
 
   tag:
     needs: [decide, build, publish]