diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
deleted file mode 100644
index 6dec95c..0000000
--- a/.github/workflows/publish.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: Publish to PyPI
-
-# Publishes when you push a version tag like v0.1.0.
-# Uses PyPI Trusted Publishing (OIDC) — no API token needed in repo secrets.
-# INERT until you configure a trusted publisher for `entroscope` on PyPI:
-#   https://docs.pypi.org/trusted-publishers/adding-a-publisher/
-#   workflow: publish.yml, environment: pypi
-
-on:
-  push:
-    tags:
-      - "v*"
-
-jobs:
-  build:
-    name: Build distribution
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-      - name: Install build tooling
-        run: pip install build twine
-      - name: Build
-        run: python -m build
-      - name: Check metadata
-        run: twine check dist/*
-      - name: Upload dist artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: dist
-          path: dist/*
-
-  publish:
-    name: Publish to PyPI
-    needs: build
-    runs-on: ubuntu-latest
-    environment: pypi
-    permissions:
-      id-token: write  # required for trusted publishing
-    steps:
-      - name: Download dist artifact
-        uses: actions/download-artifact@v7
-        with:
-          name: dist
-          path: dist
-      - name: Publish
-        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 57e6841..b161ec2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- CI: removed the tag-triggered PyPI publish workflow (`publish.yml`). Releases
+  are uploaded to PyPI manually; see "Releasing" in `CONTRIBUTING.md`.
+
 ## 0.3.1 — 2026-09-21
 
 - **Fixed (changes results):** missing and infinite values no longer produce
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2af3368..aa46260 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -74,6 +74,23 @@ Follow the existing modules as a template (shannon is the simplest):
 - Add a line to `CHANGELOG.md` under an `## Unreleased` heading.
 - Match the style of the surrounding code (ruff handles formatting).
 
+## Releasing (maintainers)
+
+CI never publishes to PyPI; uploads are done by hand.
+
+1. In a release PR, bump `version` in `pyproject.toml` and `__version__` in
+   `entroscope/__init__.py`, and rename `## Unreleased` in `CHANGELOG.md` to
+   `## X.Y.Z — YYYY-MM-DD`. Merge once CI is green.
+2. Tag the merge commit `vX.Y.Z`, push the tag, and create the GitHub release.
+3. Build from the tag and upload:
+
+   ```bash
+   git checkout vX.Y.Z
+   rm -rf dist && python -m build
+   twine check dist/*
+   twine upload dist/*
+   ```
+
 ## Reporting bugs and requesting features
 
 Open an issue at https://github.com/Par-python/entroscope/issues. For bugs, a