diff --git a/.github/workflows/python.yaml b/.github/workflows/python.yaml
index 393dbc4..b257597 100644
--- a/.github/workflows/python.yaml
+++ b/.github/workflows/python.yaml
@@ -10,6 +10,7 @@ on:
       - "pyproject.toml"
       - "murk.pyi"
       - "Cargo.toml"
+      - ".github/workflows/python.yaml"
 
 env:
   PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
@@ -46,17 +47,18 @@ jobs:
           pytest python/tests -v
 
   wheels:
-    name: Build wheels (${{ matrix.os }})
-    if: startsWith(github.ref, 'refs/tags/v')
+    name: Build wheels (${{ matrix.os }}, ${{ matrix.target }})
     needs: [lint, test]
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
         include:
           - os: ubuntu-latest
             target: x86_64
           - os: ubuntu-latest
             target: aarch64
+            manylinux: manylinux_2_28
           - os: macos-14
             target: x86_64
           - os: macos-latest
@@ -78,10 +80,13 @@ jobs:
 
       - name: Build wheels
         uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1
+        env:
+          PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
         with:
           target: ${{ matrix.target }}
-          args: --release --out dist --features python
-          manylinux: auto
+          args: --release --out dist --features python -i python3.12
+          manylinux: ${{ matrix.manylinux || 'auto' }}
+          docker-options: -e PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
 
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
@@ -90,7 +95,6 @@ jobs:
 
   sdist:
     name: Build sdist
-    if: startsWith(github.ref, 'refs/tags/v')
     needs: [lint, test]
     runs-on: ubuntu-latest
     steps:
diff --git a/Cargo.lock b/Cargo.lock
index 8b882fa..75fe5e0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1303,7 +1303,7 @@ dependencies = [
 
 [[package]]
 name = "murk-cli"
-version = "0.4.0"
+version = "0.4.1"
 dependencies = [
  "age",
  "assert_cmd",
diff --git a/Cargo.toml b/Cargo.toml
index a962f93..cbd99a6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "murk-cli"
-version = "0.4.0"
+version = "0.4.1"
 edition = "2024"
 rust-version = "1.89"
 description = "Encrypted secrets manager for developers — one file, age encryption, git-friendly"
diff --git a/python/README.md b/python/README.md
index 0116e5e..e3e3da2 100644
--- a/python/README.md
+++ b/python/README.md
@@ -1,5 +1,7 @@
 # murk-secrets
 
+[![PyPI](https://img.shields.io/pypi/v/murk-secrets)](https://pypi.org/project/murk-secrets/)
+
 Python bindings for [murk](https://github.com/iicky/murk) — an encrypted secrets manager for developers.
 
 murk stores encrypted secrets in a single `.murk` file safe to commit to git. This package lets Python apps read those secrets at runtime.