diff --git a/.github/workflows/pythonpublish.yml b/.github/workflows/pythonpublish.yml
index b81aba6..e8ae9e0 100644
--- a/.github/workflows/pythonpublish.yml
+++ b/.github/workflows/pythonpublish.yml
@@ -13,11 +13,6 @@ jobs:
   dist:
     runs-on: ubuntu-latest
 
-    environment: release
-    permissions:
-      # IMPORTANT: this permission is mandatory for trusted publishing
-      id-token: write
-
     steps:
     - uses: actions/checkout@v4
 
@@ -37,6 +32,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'release' && github.event.action == 'published'
 
+    environment: release
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
+
     steps:
     - uses: actions/download-artifact@v4
       with: