diff --git a/.github/workflows/notify-homebrew.yml b/.github/workflows/notify-homebrew.yml
index 25f7340..b84930a 100644
--- a/.github/workflows/notify-homebrew.yml
+++ b/.github/workflows/notify-homebrew.yml
@@ -20,6 +20,7 @@ jobs:
   notify:
     name: Dispatch to homebrew-tap
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - name: Resolve version
         id: version
diff --git a/.github/workflows/publish-aur.yml b/.github/workflows/publish-aur.yml
index cff5c06..f03388e 100644
--- a/.github/workflows/publish-aur.yml
+++ b/.github/workflows/publish-aur.yml
@@ -20,6 +20,7 @@ jobs:
   aur:
     name: Update AUR package
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - name: Resolve version
         id: version
diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml
index c84933c..541034d 100644
--- a/.github/workflows/publish-docker.yml
+++ b/.github/workflows/publish-docker.yml
@@ -20,6 +20,7 @@ jobs:
   docker:
     name: Build and push Docker image
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
diff --git a/docs/DISTRIBUTION_SETUP.md b/docs/DISTRIBUTION_SETUP.md
index 57574b2..c0021f7 100644
--- a/docs/DISTRIBUTION_SETUP.md
+++ b/docs/DISTRIBUTION_SETUP.md
@@ -9,7 +9,9 @@
 | **AUR** | `publish-aur.yml` | `AUR_SSH_PRIVATE_KEY`, `AUR_REPO_TOKEN` |
 | **Homebrew** | `notify-homebrew.yml` → `homebrew-tap` | `HOMEBREW_TAP_TOKEN` |
 
-Configure secrets under **Settings → Secrets and variables → Actions**.
+Configure secrets under **Settings → Environments → `pypi` → Environment secrets**
+(not repository Action secrets). Release, Docker, AUR, and Homebrew jobs all use
+`environment: pypi`.
 
 ## PyPI Trusted Publishing