diff --git a/.github/actions/reusable-python-download_dist_release/action.yml b/.github/actions/reusable-python-download_dist_release/action.yml
new file mode 100644
index 0000000..06de400
--- /dev/null
+++ b/.github/actions/reusable-python-download_dist_release/action.yml
@@ -0,0 +1,27 @@
+name: Download Python distribution files (GitHub release)
+description: >
+    Download built distribution files from a GitHub release into a local
+    "dist-download" directory, ready to be published.
+inputs:
+    release-tag:
+        description: Tag of the GitHub release to download assets from
+        required: true
+        type: string
+    github-token:
+        description: Token used to download release assets via "gh release download"
+        required: true
+        type: string
+
+runs:
+    using: composite
+    steps:
+        -   name: Download release assets
+            shell: bash
+            env:
+                GITHUB_TOKEN: ${{ inputs.github-token }}
+                GH_REPO: ${{ github.repository }}
+                INPUTS_RELEASE_TAG: ${{ inputs.release-tag }}
+            run: |
+                mkdir -p dist-download
+                cd dist-download
+                gh release download "${INPUTS_RELEASE_TAG}" -p '*.tar.gz' -p '*.whl'
diff --git a/.github/workflows/reusable-python-publish_pypi_package.yml b/.github/workflows/reusable-python-publish_pypi_package.yml
index 82bb7c0..ecde433 100644
--- a/.github/workflows/reusable-python-publish_pypi_package.yml
+++ b/.github/workflows/reusable-python-publish_pypi_package.yml
@@ -22,7 +22,9 @@ on:
             type: boolean
             default: true
         virtual-repo-names:
-            description: 'List of virtual repository names to publish to (e.g. ["public-pypi-dev", "geophysics-pypi-dev"])'
+            description: >
+                List of virtual repository names to publish to (e.g. ["public-pypi-dev", "geophysics-pypi-dev"]).
+                "pypi"/"test-pypi" are a deliberate no-op here; PyPI publishing runs in the caller.
             required: true
             type: string
         os:
@@ -139,14 +141,13 @@ jobs:
                     artifactory-dir-path: ${{ matrix.virtual-repo-name }}/${{ inputs.package-name }}/${{ env.version }}
                     JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
-            -   name: Publish package to PyPI
-                if: ${{ matrix.virtual-repo-name == 'pypi'  || matrix.virtual-repo-name == 'test-pypi'}}
-                uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
-                with:
-                    verbose: true
-                    packages-dir: ${{ env.build-dir-path }}/
-                    repository-url: https://${{ matrix.virtual-repo-name == 'test-pypi' && 'test.pypi' || 'upload.pypi'}}.org/legacy/
-                    password: ${{ secrets.PYPI_TOKEN }}
+            -   name: Fail on PyPI/TestPyPI virtual-repo-name
+                if: ${{ matrix.virtual-repo-name == 'pypi' || matrix.virtual-repo-name == 'test-pypi' }}
+                env:
+                    VIRTUAL_REPO_NAME: ${{ matrix.virtual-repo-name }}
+                run: |
+                    echo "::error::Not publishing '${VIRTUAL_REPO_NAME}' here: PyPI trusted publishing must run as a direct step in the caller's top-level workflow, not through this reusable workflow. See the 'virtual-repo-names' input description."
+                    exit 1
 
     add_release_asset:
         name: Add release asset
diff --git a/.github/workflows/reusable-python-release_pypi_assets.yml b/.github/workflows/reusable-python-release_pypi_assets.yml
index ef9d77d..4cd4e56 100644
--- a/.github/workflows/reusable-python-release_pypi_assets.yml
+++ b/.github/workflows/reusable-python-release_pypi_assets.yml
@@ -9,8 +9,8 @@ on:
             type: string
         virtual-repo-names:
             description: >
-                List of repository names to publish to
-                (e.g. ["public-pypi-prod", "geophysics-pypi-prod"])
+                List of repository names to publish to (e.g. ["public-pypi-prod", "geophysics-pypi-prod"]).
+                "pypi"/"test-pypi" are a deliberate no-op here; PyPI publishing runs in the caller (DEVOPS-1154).
             required: true
             type: string
         release-tag:
@@ -69,11 +69,10 @@ jobs:
                     artifactory-dir-path: ${{ matrix.virtual-repo-name }}/${{ inputs.package-name }}/${{ inputs.release-tag }}
                     JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
-            -   name: Publish package to PyPI
-                if: ${{ matrix.virtual-repo-name == 'pypi'  || matrix.virtual-repo-name == 'test-pypi'}}
-                uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
-                with:
-                    verbose: true
-                    packages-dir: download-assets/
-                    repository-url: https://${{ matrix.virtual-repo-name == 'test-pypi' && 'test.pypi' || 'upload.pypi'}}.org/legacy/
-                    password: ${{ secrets.PYPI_TOKEN }}
+            -   name: Fail on PyPI/TestPyPI virtual-repo-name
+                if: ${{ matrix.virtual-repo-name == 'pypi' || matrix.virtual-repo-name == 'test-pypi' }}
+                env:
+                    VIRTUAL_REPO_NAME: ${{ matrix.virtual-repo-name }}
+                run: |
+                    echo "::error::Not publishing '${VIRTUAL_REPO_NAME}' here: PyPI trusted publishing must run as a direct step in the caller's top-level workflow, not through this reusable workflow. See the 'virtual-repo-names' input description."
+                    exit 1