diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
new file mode 100644
index 0000000..15f1b4e
--- /dev/null
+++ b/.github/workflows/wheels.yml
@@ -0,0 +1,72 @@
+name: Wheels
+
+# Wheels are checked on pull requests and published when a GitHub release is published,
+# under the release's tag, such as 2.0.0.
+on:
+  pull_request:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sdist:
+    name: Source distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
+      - run: pipx run build --sdist
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist-sdist
+          path: dist/*.tar.gz
+
+  wheels:
+    name: Wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
+      # Builds every CPython cibuildwheel supports, free-threaded included, and runs
+      # the tests in pyproject.toml's [tool.cibuildwheel] against each wheel.
+      - uses: pypa/cibuildwheel@v4.3.0
+        env:
+          CIBW_ARCHS_WINDOWS: AMD64  # 64-bit only, as CI covers
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist-wheels-${{ matrix.os }}
+          path: wheelhouse/*.whl
+
+  publish:
+    name: Publish to PyPI
+    if: github.event_name == 'release' && github.repository == 'artem-ogre/PythonCDT'  # a fork's release builds the wheels but never publishes
+    needs: [sdist, wheels]
+    runs-on: ubuntu-latest
+    # PyPI trusted publishing: no token is stored, PyPI trusts this workflow in this repository.
+    environment:
+      name: pypi
+      url: https://pypi.org/p/PythonCDT
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: dist-*
+          path: dist
+          merge-multiple: true
+      - uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: dist/*
+      - uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/pyproject.toml b/pyproject.toml
index 135e709..4732ba5 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -18,8 +18,10 @@ filterwarnings = ["error"]
 testpaths = ["cdt_bindings_test.py"]
 
 [tool.cibuildwheel]
-test-command = "pytest {project}/cdt_bindings_test.py"
+test-command = "pytest cdt_bindings_test.py"
+test-sources = ["cdt_bindings_test.py", "CDT/visualizer/data"]  # the tests read input files by paths relative to the project
 test-extras = ["test"]
+test-requires = ["numpy"]  # the tests import numpy; the test extra holds only pytest
 test-skip = ["*universal2:arm64"]
 # Setuptools bug causes collision between pypy and cpython artifacts
 before-build = "rm -rf {project}/build"