diff --git a/.github/workflows/publish-main.yml b/.github/workflows/publish-main.yml
index 758f942..e341729 100644
--- a/.github/workflows/publish-main.yml
+++ b/.github/workflows/publish-main.yml
@@ -1,13 +1,15 @@
 name: Upload to Test PyPI
 
-# On every push to main, push to Test PyPI
 on:
+  # On every push to main, push to Test PyPI
   push:
     #branches:
-    #  - main
+    #  - main  # TODO
+
+  # On new releases, push to PyPI
+  release:
+    types: [published]
 
-# TODO: De-duplicate with build-test.yml
-# TODO: De-duplicate with python-publish-release.yml
 
 jobs:
   build:
@@ -45,13 +47,56 @@ jobs:
         name: python-dist
         path: dist/
 
+    - name: Environment select
+      # https://www.codewrecks.com/post/github/choose-environment-from-branch/
+      # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-output-parameter
+      # https://docs.github.com/en/actions/learn-github-actions/contexts#github-context
+      id: environment_select
+      run: |
+        echo "github.event_name=\"${{ github.event_name }}\""
+        echo "github.ref_type=\"${{ github.ref_type }}\""
+        echo "github.ref=\"${{ github.ref }}\""
+
+        case "${{ github.event_name }}" in
+          push)
+            echo "Triggered by push to ${{ github.ref }}"
+            if [ "${{ github.ref_type }}" == "branch" ]; then
+              if [ "${{ github.ref_name }}" == "publish-to-pypi" ]; then  # TODO: main
+                echo "ENV_NAME=TestPyPI" >> $GITHUB_OUTPUT
+              else
+                echo "Unexpected ref_name: \"${{ github.ref_name }}\""
+                exit 6
+              fi
+            else
+              echo "Unexpected ref_type: \"${{ github.ref_type}}\""
+              exit 6
+            fi
+            ;;
+
+          release)
+            echo "Triggered by release to ${{ github.ref }}"
+            if [ "${{ github.ref_type }}" == "tag" ]; then
+              echo "ENV_NAME=PyPI" >> $GITHUB_OUTPUT
+            else
+              echo "Unexpected ref_type: \"${{ github.ref_type}}\""
+              exit 6
+            fi
+            ;;
+
+          *)
+            echo "Unexpected trigger: ${{ github.event_name }}"
+            exit 6
+            ;;
+        esac
+
 
   pypi-publish:
     name: Upload release to Test PyPI
+    needs: [build]
     runs-on: ubuntu-latest
     environment:
-      name: TestPyPI
-      url: ${{ vars.PROJECT_URL }}
+      name: ${{ needs.build.outputs.ENV_NAME }}
+      url: ${{ vars.PROJECT_URL }}  # from environment
     permissions:
       id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
     steps:
@@ -61,11 +106,16 @@ jobs:
         name: python-dist
         path: dist/
 
-    - name: Display downloaded files
-      run: ls -R
+    - name: Dry run
+      run: |
+        ls -R
+        echo "Selected environment: \"${{ needs.build.outputs.ENV_NAME }}\""
+        echo "PROJECT_URL: ${{ vars.PROJECT_URL }}"
+        echo "UPLOAD_URL: ${{ vars.UPLOAD_URL }}"
 
     - name: Publish
+      if: false
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
         print-hash: true
-        repository-url: ${{ vars.UPLOAD_URL }}
+        repository-url: ${{ vars.UPLOAD_URL }}  # from environment