diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 6d8690e..f5e54ba 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -7,6 +7,8 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v3
       - name: Set up Python
@@ -17,18 +19,15 @@ jobs:
         run: |
           python --version
           python -m pip install --upgrade pip
-          pip install setuptools wheel twine
+          pip install setuptools wheel build
       - name: Test
         run: |
           pip install .[test]
           pytest --runslow ./tests
-      - name: Build and publish
-        env:
-          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        run: |
-          python setup.py sdist bdist_wheel
-          twine upload dist/*
+      - name: Build
+        run: python -m build
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1
       - name: Send mail
         # Notify when cron job fails
         if: failure()
@@ -48,4 +47,4 @@ jobs:
           to: uw_ihme_simulationscience@uw.edu
           # from email name
           from: Vivarium Notifications
-          
\ No newline at end of file
+          
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index fc3e9a4..321471f 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -1,3 +1,7 @@
+**3.1.2 - 01/09/24**
+
+ - Update PyPI to 2FA with trusted publisher (GitHub Actions)
+
 **3.1.1 - 07/13/23**
 
  - Changes version metadata to use setuptools_scm