diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0b7c1b5..8dd9628 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,13 +16,31 @@ jobs:
 
       - name: Check version numbers
         run: ./version.sh
-  
+
+  make_sdist:
+    name: Make SDist
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+
+    - name: Build SDist
+      run: pipx run build --sdist
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: cibw-sdist
+        path: dist/*.tar.gz
+
   package-python:
     strategy:
       fail-fast: false
       matrix:
         os:
           - ubuntu-latest
+          - macos-13
+          - macos-latest
 
     runs-on: ${{ matrix.os }}
 
@@ -32,42 +50,37 @@ jobs:
         with:
           submodules: 'true'
 
-      - name: Upgrade pip and build
-        run: |
-          python3 -m pip install --upgrade pip
-          python3 -m pip install --upgrade build
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v2.22.0
 
-      - name: Build wheel
-        run: python3 -m build
-            
       - name: Upload binary wheel
         uses: actions/upload-artifact@v4
         with:
-          name: dist
-          path: ./dist/*.whl
+          name: cibw-wheels-${{ matrix.os }}
+          path: ./wheelhouse/*.whl
       
   deploy:
+    environment:
+      name: pypi
+      url: https://pypi.org/p/libbash
     needs:
       - check-version-numbers
       - package-python
+    permissions:
+      id-token: write
     runs-on: ubuntu-latest
     if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags')
       
     steps:
       - name: Download distributions
         uses: actions/download-artifact@v4
+        with:
+          path: dist
+          pattern: cibw-*
+          merge-multiple: true
 
       - name: Deploy test distribution to Test PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-          verbose: true
-          repository_url: https://test.pypi.org/legacy/
-          skip_existing: true            
-              
-      - name: Deploy tagged release on PyPI
-        if: startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
           verbose: true
+          skip_existing: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1370732..6651058 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -15,7 +15,10 @@ jobs:
       fail-fast: false
       matrix:
         os:
+          - ubuntu-20.04 # earliest pash supports currently
           - ubuntu-latest
+          - macos-13
+          - macos-latest
     runs-on: ${{ matrix.os }}
     if: github.event.pull_request.draft == false
     steps:
diff --git a/pyproject.toml b/pyproject.toml
index de7e076..91bcad2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -22,3 +22,9 @@ Issues = "https://github.com/binpash/libbash/issues"
 [build-system]
 requires = ["setuptools>=61.0"]
 build-backend = "setuptools.build_meta"
+
+[tool.cibuildwheel.macos]
+# doesn't work for some reason
+# shouldn't be necessary since bash has no
+# dependencies besides libc (checked on linux with audit wheel)
+repair-wheel-command = ""