diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index eb3940b6fef..176daa1b4d7 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -35,20 +35,52 @@ jobs:
       with:
         attest-build-provenance-github: 'true'
 
-  deploy:
-    if: github.repository == 'pytest-dev/pytest'
+  generate-gh-release-notes:
     needs: [package]
     runs-on: ubuntu-latest
-    environment: deploy
     timeout-minutes: 30
     permissions:
-      id-token: write
-      contents: write
+      contents: read
     steps:
     - uses: actions/checkout@v5
       with:
-        persist-credentials: true
+        fetch-depth: 0
+        persist-credentials: false
+
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: "3.13"
+
+    - name: Install tox
+      run: |
+        python -m pip install --upgrade pip
+        pip install --upgrade tox
 
+    - name: Generate release notes
+      env:
+        VERSION: ${{ github.event.inputs.version }}
+      run: |
+        tox -e generate-gh-release-notes -- "$VERSION" gh-release-notes.md
+
+    - name: Upload release notes
+      uses: actions/upload-artifact@v4
+      with:
+        name: release-notes
+        path: gh-release-notes.md
+        retention-days: 1
+
+  publish-to-pypi:
+    if: github.repository == 'pytest-dev/pytest'
+    # Need generate-gh-release-notes only for ordering.
+    # Don't want to release to PyPI if generating GitHub release notes fails.
+    needs: [package, generate-gh-release-notes]
+    runs-on: ubuntu-latest
+    environment: deploy
+    timeout-minutes: 30
+    permissions:
+      id-token: write
+    steps:
     - name: Download Package
       uses: actions/download-artifact@v6
       with:
@@ -60,6 +92,18 @@ jobs:
       with:
         attestations: true
 
+  push-tag:
+    needs: [publish-to-pypi]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        fetch-depth: 0
+        persist-credentials: true
+
     - name: Push tag
       env:
           VERSION: ${{ github.event.inputs.version }}
@@ -69,48 +113,28 @@ jobs:
         git tag --annotate --message=v"$VERSION" "$VERSION" ${{ github.sha }}
         git push origin "$VERSION"
 
-  release-notes:
-
-    # todo: generate the content in the build  job
-    #       the goal being of using a github action script to push the release data
-    #       after success instead of creating a complete python/tox env
-    needs: [deploy]
+  create-github-release:
+    needs: [push-tag, generate-gh-release-notes]
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 10
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@v5
-      with:
-        fetch-depth: 0
-        persist-credentials: false
-
     - name: Download Package
       uses: actions/download-artifact@v6
       with:
         name: Packages
         path: dist
 
-    - name: Set up Python
-      uses: actions/setup-python@v6
+    - name: Download release notes
+      uses: actions/download-artifact@v6
       with:
-        python-version: "3.11"
-
-    - name: Install tox
-      run: |
-        python -m pip install --upgrade pip
-        pip install --upgrade tox
-
-    - name: Generate release notes
-      env:
-        VERSION: ${{ github.event.inputs.version }}
-      run: |
-        sudo apt-get install pandoc
-        tox -e generate-gh-release-notes -- "$VERSION" scripts/latest-release-notes.md
+        name: release-notes
+        path: .
 
     - name: Publish GitHub Release
       env:
         VERSION: ${{ github.event.inputs.version }}
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
-        gh release create --notes-file scripts/latest-release-notes.md --verify-tag "$VERSION" dist/*
+        gh release create --notes-file gh-release-notes.md --verify-tag "$VERSION" dist/*
diff --git a/.github/workflows/doc-check-links.yml b/.github/workflows/doc-check-links.yml
index bf88c2b3c6c..497ec73500a 100644
--- a/.github/workflows/doc-check-links.yml
+++ b/.github/workflows/doc-check-links.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.11"
+          python-version: "3.13"
           cache: pip
 
       - name: Install dependencies
diff --git a/.github/workflows/prepare-release-pr.yml b/.github/workflows/prepare-release-pr.yml
index e46a307d0ef..9dcfea7bae5 100644
--- a/.github/workflows/prepare-release-pr.yml
+++ b/.github/workflows/prepare-release-pr.yml
@@ -36,7 +36,7 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
-        python-version: "3.x"
+        python-version: "3.13"
 
     - name: Install dependencies
       run: |
diff --git a/.github/workflows/update-plugin-list.yml b/.github/workflows/update-plugin-list.yml
index aca22a6dd95..b396d6e19d4 100644
--- a/.github/workflows/update-plugin-list.yml
+++ b/.github/workflows/update-plugin-list.yml
@@ -28,8 +28,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.11"
-          cache: pip
+          python-version: "3.13"
 
       - name: requests-cache
         uses: actions/cache@v4
@@ -38,13 +37,13 @@ jobs:
           key: plugins-http-cache-${{ github.run_id }} # Can use time based key as well
           restore-keys: plugins-http-cache-
 
-      - name: Install dependencies
+      - name: Install tox
         run: |
           python -m pip install --upgrade pip
-          pip install packaging requests tabulate[widechars] tqdm requests-cache platformdirs
+          pip install --upgrade tox
 
       - name: Update Plugin List
-        run: python scripts/update-plugin-list.py
+        run: tox -e update-plugin-list
 
       - name: Create Pull Request
         id: pr
diff --git a/RELEASING.rst b/RELEASING.rst
index 57e1e176a80..79b4e2f764d 100644
--- a/RELEASING.rst
+++ b/RELEASING.rst
@@ -133,7 +133,7 @@ Releasing
 
 Both automatic and manual processes described above follow the same steps from this point onward.
 
-#. After all tests pass and the PR has been approved, trigger the ``deploy`` job
+#. After all tests pass and the PR has been approved, trigger the ``deploy`` workflow
    in https://github.com/pytest-dev/pytest/actions/workflows/deploy.yml, using the ``release-MAJOR.MINOR.PATCH`` branch
    as source.
 
diff --git a/scripts/generate-gh-release-notes.py b/scripts/generate-gh-release-notes.py
index b6d92d085e1..d293a3bb695 100644
--- a/scripts/generate-gh-release-notes.py
+++ b/scripts/generate-gh-release-notes.py
@@ -43,7 +43,7 @@ def extract_changelog_entries_for(version: str) -> str:
 
 def convert_rst_to_md(text: str) -> str:
     result = pypandoc.convert_text(
-        text, "md", format="rst", extra_args=["--wrap=preserve"]
+        text, "gfm", format="rst", extra_args=["--wrap=preserve"]
     )
     assert isinstance(result, str), repr(result)
     return result
diff --git a/tox.ini b/tox.ini
index 1203bfe2352..b6fcecc886a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -212,5 +212,17 @@ commands = python scripts/prepare-release-pr.py {posargs}
 description = generate release notes that can be published as GitHub Release
 usedevelop = True
 deps =
-    pypandoc
+    pypandoc_binary
 commands = python scripts/generate-gh-release-notes.py {posargs}
+
+[testenv:update-plugin-list]
+description = update the plugin list
+skip_install = True
+deps =
+    packaging
+    requests
+    tabulate[widechars]
+    tqdm
+    requests-cache
+    platformdirs
+commands = python scripts/update-plugin-list.py {posargs}