diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 475966f..ff58583 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -7,21 +7,35 @@ on:
 
 jobs:
 
-  deploy:
+  package:
 
     runs-on: ubuntu-latest
 
+    # Required by attest-build-provenance-github.
+    permissions:
+      id-token: write
+      attestations: write
+
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
+
     - name: Build and Check Package
-      uses: hynek/build-and-inspect-python-package@v1.5
+      uses: hynek/build-and-inspect-python-package@v3.0.1
+      with:
+        attest-build-provenance-github: 'true'
+
+  deploy:
+
+    needs: [package]
+
+    runs-on: ubuntu-latest
+
+    steps:
     - name: Download Package
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v8
       with:
         name: Packages
         path: dist
+
     - name: Publish package to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        user: __token__
-        password: ${{ secrets.pypi_token }}
+      uses: pypa/gh-action-pypi-publish@v1.14.2
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3bc9f9b..276091c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -3,43 +3,48 @@ name: test
 on: [push, pull_request]
 
 jobs:
+
+  package:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@v7
+      - name: Build and Check Package
+        uses: hynek/build-and-inspect-python-package@v3.0.1
+
   test:
 
+    needs: [package]
+
     runs-on: ubuntu-latest
 
     strategy:
       fail-fast: false
       matrix:
         python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
-        include:
-          - python: "3.10"
-            tox_env: "py310"
-          - python: "3.11"
-            tox_env: "py311"
-          - python: "3.12"
-            tox_env: "py312"
-          - python: "3.13"
-            tox_env: "py313"
-          - python: "3.14"
-            tox_env: "py314"
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
+
+    - name: Download Package
+      uses: actions/download-artifact@v8
+      with:
+        name: Packages
+        path: dist
+
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python }}
+        allow-prereleases: true
+
     - name: Install tox
       run: |
         python -m pip install --upgrade pip
         pip install tox
+
     - name: Test
       run: |
-        tox -e ${{ matrix.tox_env }}
-
-  check-package:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-    - name: Build and Check Package
-      uses: hynek/build-and-inspect-python-package@v2
+        tox run -e py --installpkg `find dist/*.tar.gz`
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 6515b82..558a343 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -1,5 +1,5 @@
-UNRELEASED
-==========
+v1.7.4
+======
 
 * Drop support for EOL Python versions: 3.7, 3.8, 3.9.
 * Print proper child process exit status.
diff --git a/RELEASING.rst b/RELEASING.rst
index 1a9d8f2..ec884a8 100644
--- a/RELEASING.rst
+++ b/RELEASING.rst
@@ -1,7 +1,7 @@
 Here are the steps on how to make a new release.
 
-1. Create a ``release-VERSION`` branch from ``upstream/master``.
+1. Create a ``release-<VERSION>`` branch from ``upstream/master``.
 2. Update ``CHANGELOG.rst``.
-3. Push a branch with the changes.
-4. Once all builds pass, push a tag to ``upstream``.
+3. Push a branch with the changes to ``upstream``.
+4. Once all builds pass, push a tag to ``upstream`` in the format ``v<VERSION>``.
 5. Merge the PR.