diff --git a/.github/workflows/build-and-deploy-docs.yml b/.github/workflows/build-and-deploy-docs.yml
index 34be69f..205618d 100644
--- a/.github/workflows/build-and-deploy-docs.yml
+++ b/.github/workflows/build-and-deploy-docs.yml
@@ -1,52 +1,57 @@
 name: docs/gh-pages
+
 on:
   release:
-    types: [workflow_dispatch, released]
+    types: [released]
+  workflow_dispatch:
 
+permissions:
+  contents: write
+  
 jobs:
     build-docs:
-        name: Build docs and push to gh-pages
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout branch
-              uses: actions/checkout@v4
+      name: Build docs and push to gh-pages
+      runs-on: ubuntu-latest
+      steps:
+        - name: Checkout branch
+          uses: actions/checkout@v4
 
-            - name: Setup python 
-              uses: actions/setup-python@master
-              with:
-                python-version: 3.10.5
+        - name: Setup python 
+          uses: actions/setup-python@v4
+          with:
+            python-version: 3.10.5
             
-            - name: Install poetry
-              uses: snok/install-poetry@v1.3.3
-              with:
-                version: 1.8.4
-                virtualenvs-create: true
-                virtualenvs-in-project: true
-                installer-parallel: true
+        - name: Install poetry
+          uses: snok/install-poetry@v1.3.3
+          with:
+            version: 1.8.4
+            virtualenvs-create: true
+            virtualenvs-in-project: true
+            installer-parallel: true
 
-            - name: Load cached venv
-              id: cached-poetry-dependencies
-              uses: actions/cache@v2
-              with:
-                path: .venv
-                key: venv-${{ runner.os }}-${{ hashFiles('**/poetry.lock') }}
+        - name: Load cached venv
+          id: cached-poetry-dependencies
+          uses: actions/cache@v4
+          with:
+            path: .venv
+            key: venv-${{ runner.os }}-${{ hashFiles('**/poetry.lock') }}
             
-            - name: Install dependencies
-              if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
-              run: poetry install --no-interaction --no-root
+        - name: Install dependencies
+          if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
+          run: poetry install --no-interaction --no-root
 
-            - name: build docs
-              run: |
-                source .venv/bin/activate
-                cd docs
-                make clean
-                make html
-                cd ..
+        - name: build docs
+          run: |
+            source .venv/bin/activate
+            cd docs
+            make clean
+            make html
+            cd ..
             
-            - name: Deploy to GitHub Pages
-              uses: Cecilapp/GitHub-Pages-deploy@v3
-              env:
-                GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-              with:
-                email: dhagan@mit.edu
-                build_dir: docs/_build/html
\ No newline at end of file
+        - name: Deploy to GitHub Pages
+          uses: Cecilapp/GitHub-Pages-deploy@v3
+          env:
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          with:
+            email: dhagan@mit.edu
+            build_dir: docs/_build/html
\ No newline at end of file
diff --git a/.github/workflows/docs-preview.yml b/.github/workflows/docs-preview.yml
index 43e3cc0..6f0d862 100644
--- a/.github/workflows/docs-preview.yml
+++ b/.github/workflows/docs-preview.yml
@@ -1,4 +1,5 @@
 name: docs/preview
+
 on:
   pull_request:
     paths:
@@ -14,7 +15,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v4
         with:
           python-version: 3.10.5
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8bb1c19..6cd55db 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,33 +1,37 @@
 name: build & release
+
 on:
   release:
     types: [published]
 
 jobs:
-    build-n-publish:
-        name: Build and publish to PyPI
-        runs-on: ubuntu-latest
-        steps:
-            - name: Checkout branch
-              uses: actions/checkout@v4
+  build-n-publish:
+    name: Build and publish to PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - name: Checkout branch
+        uses: actions/checkout@v4
 
-            - name: Setup python 
-              uses: actions/setup-python@v4
-              with:
-                python-version: 3.10.5
+      - name: Setup python 
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.10.5
             
-            - name: Install poetry
-              uses: snok/install-poetry@v1.3.3
-              with:
-                version: 1.8.4
-                virtualenvs-create: true
-                virtualenvs-in-project: true
-                installer-parallel: true
+      - name: Install poetry
+        uses: snok/install-poetry@v1.3.3
+        with:
+          version: 1.8.4
+          virtualenvs-create: true
+          virtualenvs-in-project: true
+          installer-parallel: true
             
-            - name: Install dependencies
-              run: poetry install --no-interaction --no-root
+      - name: Install dependencies
+        run: poetry install --no-interaction --no-root
             
-            - name: Build and publish to PyPI
-              run: |
-                poetry build
-                poetry publish -u ${{ secrets.PYPI_USERNAME }} -p ${{ secrets.PYPI_PASSWORD }}
\ No newline at end of file
+      - name: Build package
+        run: poetry build
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publisher@release/v1
\ No newline at end of file
diff --git a/.github/workflows/test-and-verify.yml b/.github/workflows/test-and-verify.yml
index 06cacb6..19c86e1 100644
--- a/.github/workflows/test-and-verify.yml
+++ b/.github/workflows/test-and-verify.yml
@@ -1,5 +1,7 @@
 name: run and build
+
 on: [pull_request]
+
 jobs:
   tests:
     runs-on: ubuntu-latest
@@ -17,7 +19,7 @@ jobs:
           python-version: ${{ matrix.python }}
 
       - name: Install poetry
-        uses: snok/install-poetry@v1
+        uses: snok/install-poetry@v1.3.3
         with:
           version: 1.8.4
           virtualenvs-create: true