diff --git a/.github/workflows/build_pypi.yml b/.github/workflows/build_pypi.yml
index 94ed6a530cca..0b9099eb910b 100644
--- a/.github/workflows/build_pypi.yml
+++ b/.github/workflows/build_pypi.yml
@@ -138,11 +138,36 @@ jobs:
           VERSION_OVERRIDE: ${{ inputs.version }}
         run: poetry build
 
+      - name: Attach artifacts to release
+        if: inputs.release-id
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GIT_PAT }}
+          script: |
+            const { repo, owner } = context.repo;
+            const fs = require('fs');
+            const release_id = '${{ inputs.release-id }}';
+            for (let file of await fs.readdirSync('./dist/')) {
+               console.log('uploadReleaseAsset', file);
+               await github.rest.repos.uploadReleaseAsset({
+                  owner,
+                  repo,
+                  release_id: release_id,
+                  name: file,
+                  data: await fs.readFileSync(`./dist/${file}`)
+               });
+            }
+
+      - name: Check SDK version is not git sha
+        run: grep 'label-studio-sdk\s*=\s*"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"' pyproject.toml
+
       - name: Upload to PYPI
+        if: inputs.upload_to_pypi
         env:
           TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_APIKEY }}
-        run: poetry run twine upload ${{ inputs.upload_to_pypi == false && '--dry-run' || '' }} dist/*
+          TWINE_PASSWORD: ${{ inputs.upload_to_pypi && secrets.PYPI_APIKEY || secrets.PYPI_APIKEY_TEST }}
+          TWINE_REPOSITORY_URL: ${{ inputs.upload_to_pypi && 'https://upload.pypi.org/legacy/ ' || 'https://test.pypi.org/legacy/' }}
+        run: poetry run twine upload dist/*
 
       - name: Get PyPI package details
         id: pypi-package-details
@@ -173,26 +198,6 @@ jobs:
               }
             }, 60 * 1000 )
 
-      - name: Attach artifacts to release
-        if: inputs.release-id
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GIT_PAT }}
-          script: |
-            const { repo, owner } = context.repo;
-            const fs = require('fs');
-            const release_id = '${{ inputs.release-id }}';
-            for (let file of await fs.readdirSync('./dist/')) {
-               console.log('uploadReleaseAsset', file);
-               await github.rest.repos.uploadReleaseAsset({
-                  owner,
-                  repo,
-                  release_id: release_id,
-                  name: file,
-                  data: await fs.readFileSync(`./dist/${file}`)
-               });
-            }
-
       - name: Check file size
         env:
           DIST_DIR: "./dist"