diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b67838b..99546c7 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -65,7 +65,11 @@ pypi-twine:
     - python3 -m venv twine_env
     - source twine_env/bin/activate
     - pip install --upgrade pip
-    - pip install twine build
+    # Pin twine <6 — newer twine auto-detects GitLab CI and refuses to
+    # fall back to ~/.pypirc on the runner, requiring PYPI_ID_TOKEN
+    # (Trusted Publishing OIDC). Until we migrate to Trusted Publishing,
+    # stick with the classic ~/.pypirc auth on the build runner.
+    - pip install "twine<6" build
     - python3 -m build
     - twine check dist/*
     - twine upload --non-interactive dist/*