diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c810e5e8..f1c22ef1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,8 @@ on:
     branches:
       - master
       - testci
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
   pull_request:
     branches:
       - master
@@ -19,20 +21,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-latest]
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
         exclude:
           # Reduce matrix size - only test edge cases on all platforms
           - os: macos-latest
             python-version: "3.10"
-          - os: macos-latest  
+          - os: macos-latest
             python-version: "3.11"
           - os: macos-latest
             python-version: "3.12"
           - os: windows-latest
             python-version: "3.10"
           - os: windows-latest
-            python-version: "3.11" 
+            python-version: "3.11"
           - os: windows-latest
             python-version: "3.12"
 
@@ -56,7 +58,7 @@ jobs:
 
       - name: Verify UV installation
         run: uv --version
-          
+
       - name: Create virtual environment
         run: uv venv
 
@@ -106,8 +108,6 @@ jobs:
           files: ./coverage.xml
           token: ${{ secrets.CODECOV_TOKEN }}
 
-
-
       - name: Verify React build artifacts
         working-directory: iris
         shell: bash
@@ -139,7 +139,7 @@ jobs:
           uv run iris demo --admin-user admin --admin-password 123 &
           SERVER_PID=$!
           echo "Started IRIS server with PID: $SERVER_PID"
-          
+
           # Wait for server to be ready (max 60 seconds)
           echo "Waiting for server to start..."
           for i in {1..60}; do
@@ -154,16 +154,55 @@ jobs:
             fi
             sleep 1
           done
-          
+
           # Run Cypress tests in headless mode (from iris/ subdirectory)
           echo "Running Cypress E2E tests..."
           cd iris
           npm run cypress:headless || TEST_EXIT_CODE=$?
-          
+
           # Stop the server
           echo "Stopping IRIS server..."
           kill $SERVER_PID 2>/dev/null || true
           wait $SERVER_PID 2>/dev/null || true
-          
+
           # Exit with test result
           exit ${TEST_EXIT_CODE:-0}
+
+      - name: Install pypa/build & build a binary wheel and a source tarball
+        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
+        run: |
+          python -m pip install build --user
+          python -m build
+
+      - name: Store the distribution packages
+        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
+        uses: actions/upload-artifact@v5
+        with:
+          name: python-package-distributions
+          path: dist/
+
+  publish-to-testpypi:
+    name: Publish Python 🐍 distribution 📦 to TestPyPI
+    needs:
+    - test
+    runs-on: ubuntu-latest
+
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/esa-iris
+
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v6
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution 📦 to TestPyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: https://test.pypi.org/legacy/
+        verbose: true
+        skip-existing: true
diff --git a/MANIFEST.in b/MANIFEST.in
deleted file mode 100644
index 5b92652f..00000000
--- a/MANIFEST.in
+++ /dev/null
@@ -1,8 +0,0 @@
-recursive-include demo *.tif
-recursive-include demo *.png
-recursive-include demo *.json
-recursive-include iris *.png
-recursive-include iris *.html
-recursive-include iris *.css
-recursive-include iris *.js
-recursive-include iris *.json
diff --git a/demo/__init__.py b/demo/__init__.py
new file mode 100644
index 00000000..d72e34e9
--- /dev/null
+++ b/demo/__init__.py
@@ -0,0 +1 @@
+# dummy Python module for rearranging files for packaging
diff --git a/iris/__init__.py b/iris/__init__.py
index 1af5dede..0d41127a 100644
--- a/iris/__init__.py
+++ b/iris/__init__.py
@@ -19,11 +19,12 @@
 
 
 def get_demo_file(example=None):
-    demo_file = join(
-        os.getcwd(), "demo", "cloud-segmentation.json"
-    )
+    demo_file_repo = Path(__file__).parent.parent / "demo" / "cloud-segmentation.json"
+    demo_file_installed = Path(__file__).parent / "demo" / "cloud-segmentation.json"
+
+    demo_file = demo_file_repo if demo_file_repo.exists() else demo_file_installed
+    return str(demo_file)
 
-    return demo_file
 
 def find_config_file(folder_path: Union[str, Path]) -> Union[Path, None]:
     """Find a suitable config file in the given folder.
diff --git a/pyproject.toml b/pyproject.toml
index a8d247cb..f9305abb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -54,14 +54,23 @@ Repository = "https://github.com/ESA-PhiLab/iris"
 [project.scripts]
 iris = "iris:run_app"
 
+[tool.setuptools]
+include-package-data = true
+
 [tool.setuptools.dynamic]
 version = {attr = "iris.__version__"}
 
 [tool.setuptools.packages.find]
-include = ["iris*"]
+where = ["."]
+include = ["iris", "iris.*", "iris.demo"]
+
+# Map the package name `iris.demo` to the *directory* `demo/`
+[tool.setuptools.package-dir]
+"iris.demo" = "demo"
 
 [tool.setuptools.package-data]
 iris = ["*.json", "*/templates/*", "*/static/*/*"]
+"iris.demo" = ["**/*"]
 
 [tool.black]
 line-length = 120