diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 53d6266ec..e66ecd75d 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -177,13 +177,13 @@ jobs:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     uses: ./.github/workflows/publish-gh-pages.yml
     with:
-      publish_dir: ./coverage
       destination_dir: coverage
       artifact_name: coverage
+    # A called workflow's jobs cannot request more than the caller grants, and
+    # an enumerated block sets every unlisted scope to `none`.
     permissions:
-      contents: write
-    secrets:
-      PUBLISH_DOCS_TOKEN: ${{ secrets.PUBLISH_DOCS_TOKEN }}
+      pages: write
+      id-token: write
 
   is-release:
     name: Determine whether this is a release merge commit
diff --git a/.github/workflows/publish-gh-pages.yml b/.github/workflows/publish-gh-pages.yml
index 41b6cbf30..f1aa65ffa 100644
--- a/.github/workflows/publish-gh-pages.yml
+++ b/.github/workflows/publish-gh-pages.yml
@@ -3,39 +3,39 @@ name: Publish to GitHub Pages
 on:
   workflow_call:
     inputs:
-      publish_dir:
-        description: 'Directory to publish'
-        required: true
-        type: string
       destination_dir:
-        description: 'Destination directory on gh-pages branch'
+        description:
+          'Subdirectory of the site to publish into; the deployment replaces the
+          entire site'
         required: true
         type: string
       artifact_name:
         description: 'Name of artifact to download'
         required: true
         type: string
-    secrets:
-      PUBLISH_DOCS_TOKEN:
-        required: true
 
 jobs:
   publish:
     name: Publish to GitHub Pages
     runs-on: ubuntu-latest
-    environment: github-pages
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
     permissions:
-      contents: write
+      pages: write
+      id-token: write
     steps:
       - name: Download artifact
         uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.artifact_name }}
-          path: ${{ inputs.publish_dir }}
+          path: _site/${{ inputs.destination_dir }}
 
-      - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v5
         with:
-          personal_token: ${{ secrets.PUBLISH_DOCS_TOKEN }}
-          publish_dir: ${{ inputs.publish_dir }}
-          destination_dir: ${{ inputs.destination_dir }}
+          path: _site
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5