diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
deleted file mode 100644
index 99875adde..000000000
--- a/.github/workflows/cd.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-name: CD
-
-on:  # yamllint disable-line rule:truthy
-  # From documentation:
-  # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushbranchestagsbranches-ignoretags-ignore
-  # on.push.tags: If you define only tags/tags-ignore or only branches/branches-ignore, the workflow won't run for events affecting the undefined Git ref.
-  #
-  # This workflow will only run when a tag matching the criteria is pushed
-  push:
-    tags: ["v?[0-9]+.[0-9]+.[0-9]+"]
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Code Repository
-        uses: actions/checkout@v4
-      - name: Set up Python 3.12
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-      - name: Install `pypa/build`
-        run: python -m pip install build
-      - name: Build sdist and wheel
-        run: python -m build --sdist --wheel --outdir ./dist/
-      - name: Publish package to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
new file mode 100644
index 000000000..3b03159fc
--- /dev/null
+++ b/.github/workflows/cd.yml
@@ -0,0 +1,87 @@
+name: CD
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        type: boolean
+        description: "Dry-run"
+        required: true
+        default: true
+      version:
+        description: "SemVer string for new version"
+        required: true
+
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    environment:
+      name: protected
+    steps:
+      - name: Checkout code repository
+        uses: actions/checkout@v4
+      - name: Build Python packages
+        uses: hynek/build-and-inspect-python-package@v2
+
+  tag:
+    runs-on: ubuntu-latest
+    environment:
+      name: protected
+    permissions:
+      contents: write
+    outputs:
+      new_tag: ${{ steps.tag_version.outputs.new_tag }}
+      changelog: ${{ steps.tag_version.outputs.changelog }}
+    steps:
+      - name: Checkout code repository
+        uses: actions/checkout@v4
+      - name: Tag new version
+        id: tag_version
+        uses: mathieudutour/github-tag-action@v6.2
+        with:
+          github_token: ${{ github.token }}
+          default_bump: "false"
+          custom_tag: ${{ inputs.version }}
+          tag_prefix: ""
+          dry_run: ${{ inputs.dry-run }}
+
+  release:
+    needs:
+      - build
+      - tag
+    runs-on: ubuntu-latest
+    environment:
+      name: protected
+    permissions:
+      contents: write
+    steps:
+      - name: Download built Python packages
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+      - name: Create GitHub Release with Python packages
+        uses: ncipollo/release-action@v1
+        with:
+          artifacts: dist/*
+          tag: ${{ needs.tag.outputs.new_tag }}
+          body: ${{ needs.tag.outputs.changelog }}
+          draft: ${{ inputs.dry-run }}
+
+  publish:
+    needs: release
+    runs-on: ubuntu-latest
+    if: ${{ ! inputs.dry-run }}
+    environment:
+      name: publish
+    permissions:
+      id-token: write
+    steps:
+      - name: Download built Python package
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yml
similarity index 100%
rename from .github/workflows/ci.yaml
rename to .github/workflows/ci.yml