diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1d37128..c52d111 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -86,40 +86,6 @@ jobs:
       contents: read
       id-token: write # Required for nested job 'publish'
 
-  testpypi:
-    name: Publish package to TestPyPI
-    needs:
-      - build_wheel
-    if: |
-      github.event_name != 'workflow_dispatch' &&
-      !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork)
-    environment:
-      name: ${{ github.event_name }}
-      url: https://test.pypi.org/p/python-msilib
-    permissions:
-      id-token: write # MANDATORY: Required for OIDC Trusted Publishing
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          path: wheelhouse
-          pattern: python-msilib-wheel-*
-          merge-multiple: true
-
-      - name: Publish package to TestPyPI
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
-        with:
-          packages-dir: wheelhouse/
-          repository-url: https://test.pypi.org/legacy/
-          skip-existing: true
-          verbose: true
-
   tests:
     name: Run tests
     needs:
diff --git a/.github/workflows/cmd.yml b/.github/workflows/cmd.yml
new file mode 100644
index 0000000..144d049
--- /dev/null
+++ b/.github/workflows/cmd.yml
@@ -0,0 +1,47 @@
+name: Command
+
+on:
+  issue_comment:
+    types: [created]
+
+concurrency:
+  group: pypi-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish package to TestPyPI
+    if: github.event.issue.pull_request && contains(github.event.comment.body, '/testpypi')
+    environment:
+      name: ${{ github.event_name }}
+      url: https://test.pypi.org/p/python-msilib
+    permissions:
+      id-token: write # MANDATORY: Required for OIDC Trusted Publishing
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Download all artifacts
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
+        with:
+          workflow: ci.yml
+          pr: ${{ github.event.issue.number }}
+          name: python-msilib-wheel-* # pattern
+          name_is_regexp: true
+          path: wheelhouse
+          merge_multiple: true # merge-multiple: true
+          workflow_conclusion: success
+
+      - name: Publish package to TestPyPI
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
+        with:
+          packages-dir: wheelhouse/
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+          verbose: true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 0a67158..a37d458 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -23,7 +23,7 @@ repos:
     hooks:
       - id: validate-pyproject
         additional_dependencies:
-          - validate-pyproject-schema-store[all]==2026.07.28
+          - validate-pyproject-schema-store[all]==2026.08.01
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: 39d9ac5938dadb73df0564a45f163e25ff9fa6e2 # frozen: v0.16.1
@@ -65,7 +65,7 @@ repos:
         args: [--no-sync]
 
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: 067260dc5fe6ea86b7551bfd6f8b3ba4e6c93129 # frozen: v1.28.0
+    rev: 451b56af716f9f0d0c2b816503a3fd0cf8b036fa # frozen: v1.29.0
     hooks:
       - id: zizmor
         args: ["--fix=all", "--no-progress", "-p"]