diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 87d4cbb..035d4fc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,15 +32,23 @@ jobs:
       - name: Install dependencies
         run: pip install tox
       - name: Run tests
-        run: tox -e py
+        run: tox run -e py
 
   tests-misc:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        env: [generate-integration-files, type, lint, format]
+        env:
+          - build
+          - format
+          - generate-integration-files
+          - lint
+          - type
     steps:
       - uses: actions/checkout@v5
+        with:
+          # build env: fetch all commits for version computation
+          fetch-depth: ${{ matrix.env == 'build' && '0' || '1' }}
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
@@ -48,39 +56,31 @@ jobs:
       - name: Install dependencies
         run: pip install tox
       - name: Run ${{ matrix.env }}
-        run: tox -e ${{ matrix.env }}
-
-  build:
-    needs: [tests-py, tests-misc]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          # fetch all commits for setuptools_scm
-          fetch-depth: 0
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.11"
-      - name: Build
-        run: python setup.py sdist bdist_wheel
-      - name: Save build artifacts
+        run: tox run -e ${{ matrix.env }}
+      - if: ${{ matrix.env == 'build' }}
+        name: Save ${{ matrix.env }} artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: dist
+          name: ${{ matrix.env }}
           path: dist
 
   publish:
     if: startsWith(github.ref, 'refs/tags')
-    needs: build
+    needs:
+      - tests-py
+      - tests-misc
     runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      id-token: write # This permission is mandatory for trusted publishing
     steps:
       - name: Restore build artifacts
         uses: actions/download-artifact@v5
         with:
-          name: dist
+          name: build
           path: dist
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.pypi_password }}
+          verbose: true
+          print-hash: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e11e22..b2ee4c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ adheres to [Semantic Versioning](https://semver.org/).
 - Freeze dev dependencies versions
 - Update GitHub actions dependencies
 - Add tests for PyPy 3.10 and 3.11
+- Improve tox & CI pipelines
 
 ## [0.5.0] - 2023-02-27
 
diff --git a/dev-requirements.txt b/dev-requirements.txt
index 4aa65b3..dc656c8 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -1,20 +1,19 @@
 # install + dependencies
 -e .
 
-# typing
-mypy==1.0.1
+# build
+build==1.3.0
 
-# tests
-pytest==7.2.1
-pytest-cov==4.0.0
+# format
+black==23.1.0
+isort==5.12.0
 
 # lint
 pylint==2.16.2
 
-# format
-black==23.1.0
-isort==5.12.0
+# typing
+mypy==1.0.1
 
-# publish
-setuptools_scm==7.1.0
-wheel==0.38.4
+# tests
+pytest==7.2.1
+pytest-cov==4.0.0
diff --git a/setup.cfg b/setup.cfg
index a1cdc01..e21f8e5 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -32,5 +32,4 @@ package_dir = =src
 packages = xz
 python_requires = >=3.9
 setup_requires =
-    setuptools_scm
-    wheel
+    setuptools_scm==7.1.0
diff --git a/tox.ini b/tox.ini
index 3997ce6..748aec3 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,9 +1,13 @@
+# for moving this file into pyproject.toml, see https://github.com/tox-dev/tox/issues/999
+
 [tox]
 envlist =
     py, py39, py310, py311, pypy3
-    generate-integration-files, type, lint, format
+    build, format, generate-integration-files, lint, type
 
 [testenv]
+package = wheel
+wheel_build_env = .pkg # reuse same wheel across envs
 deps =
     pytest==7.2.1
     pytest-cov==4.0.0
@@ -15,6 +19,24 @@ commands =
     pytest {posargs:-vv --cov-fail-under=100}
     py: -coverage html
 
+[testenv:build]
+basepython = python3.11
+skip_install = true
+deps =
+    build==1.3.0
+commands =
+    python -m build
+
+[testenv:format]
+basepython = python3.11
+skip_install = true
+deps =
+    black==23.1.0
+    isort==5.12.0
+commands =
+    black {posargs:--check --diff} src tests
+    isort {posargs:--check --diff} src tests
+
 [testenv:generate-integration-files]
 basepython = python3.11
 deps =
@@ -26,15 +48,6 @@ setenv =
     PYTHONDEVMODE = 1
 commands = pytest -vv -m generate_integration_files --generate-integration-files
 
-[testenv:type]
-basepython = python3.11
-deps =
-    mypy==1.0.1
-    pytest==7.2.1 # for typing
-commands =
-    mypy
-    mypy --namespace-packages --explicit-package-bases tests
-
 [testenv:lint]
 basepython = python3.11
 deps =
@@ -44,12 +57,11 @@ commands =
     pylint src
     pylint -d duplicate-code,too-many-statements,use-implicit-booleaness-not-comparison tests
 
-[testenv:format]
+[testenv:type]
 basepython = python3.11
-skip_install = true
 deps =
-    black==23.1.0
-    isort==5.12.0
+    mypy==1.0.1
+    pytest==7.2.1 # for typing
 commands =
-    black {posargs:--check --diff} src tests
-    isort {posargs:--check --diff} src tests
+    mypy
+    mypy --namespace-packages --explicit-package-bases tests