diff --git a/.github/workflows/release-main.yml b/.github/workflows/release-main.yml
index 15e8bb67774..33c72cd51e8 100644
--- a/.github/workflows/release-main.yml
+++ b/.github/workflows/release-main.yml
@@ -26,7 +26,7 @@ jobs:
           CIRQ_PYPI_TOKEN: ${{ secrets.CIRQ_PYPI_TOKEN }}
           CIRQ_TEST_PYPI_TOKEN: ${{ secrets.CIRQ_TEST_PYPI_TOKEN }}
         run: |
-          dev_tools/packaging/create_pypirc.sh
+          envsubst < dev_tools/packaging/pypirc_template > $HOME/.pypirc
       - name: Build and publish
         run: |
           export CIRQ_PRE_RELEASE_VERSION=$(dev_tools/packaging/generate-dev-version-id.sh)
diff --git a/dev_tools/packaging/create_pypirc.sh b/dev_tools/packaging/create_pypirc.sh
deleted file mode 100644
index 8adaf3b8a2f..00000000000
--- a/dev_tools/packaging/create_pypirc.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!bin/bash
-
-# Create default pypi config file with token authentication.
-# refrence: https://packaging.python.org/en/latest/specifications/pypirc/#common-configurations
-echo """
-[pypi]
-username = __token__
-password = ${CIRQ_PYPI_TOKEN}
-
-[testpypi]
-username = __token__
-password = ${CIRQ_TEST_PYPI_TOKEN}
-""" >> $HOME/.pypirc
diff --git a/dev_tools/packaging/pypirc_template b/dev_tools/packaging/pypirc_template
new file mode 100644
index 00000000000..888bd64a7c9
--- /dev/null
+++ b/dev_tools/packaging/pypirc_template
@@ -0,0 +1,7 @@
+[pypi]
+username = __token__
+password = ${CIRQ_PYPI_TOKEN}
+
+[testpypi]
+username = __token__
+password = ${CIRQ_TEST_PYPI_TOKEN}