diff --git a/jobs/swh/sandbox.yaml b/jobs/swh/sandbox.yaml
--- a/jobs/swh/sandbox.yaml
+++ b/jobs/swh/sandbox.yaml
@@ -7,5 +7,6 @@
       - "{name}/incoming-tag"
       - "{name}/tests"
       - "{name}/tox"
+      - "{name}/pypi-upload"
       - "debian/packages/{name}"
       - "debian/packages/{name}/update-for-release"
diff --git a/jobs/templates/incoming-tag.groovy b/jobs/templates/incoming-tag.groovy
--- a/jobs/templates/incoming-tag.groovy
+++ b/jobs/templates/incoming-tag.groovy
@@ -35,11 +35,10 @@
       }}
       steps {{
         build(
-          job: '/{name}/pypi',
+          job: '/{name}/pypi-upload',
           parameters: [
             string(name: 'GIT_TAG', value: params.GIT_TAG),
           ],
-          wait: false,
         )
       }}
     }}
diff --git a/jobs/templates/swh-pipeline.yaml b/jobs/templates/swh-pipeline.yaml
--- a/jobs/templates/swh-pipeline.yaml
+++ b/jobs/templates/swh-pipeline.yaml
@@ -18,23 +18,6 @@
       - string:
           name: PHID
           description: PHID of the Phabricator target object on which results will be reported.
-      - string:
-          name: PYPI
-          description: |
-            PYPI registry to publish to when built revision is a tag. There
-            must exists a usernamePassword credential object with that name.
-            The pypi JSON API endpoint is built as https://$PYPI/project/<name>/json
-          default: test.pypi.org
-      - string:
-          name: PYPI_UPLOAD
-          description: |
-            PYPI upload base host. If unset, defaults to $PYPI. The upload endpoint is built as
-            https://$PYPI_UPLOAD/legagy/
-      - bool:
-          name: FORCE_UPLOAD
-          default: false
-          description: |
-            Force uploading python packages on the chosen PYPI registry.
 
     dsl: |
       pipeline {{
@@ -117,37 +100,6 @@
               }}
             }} // post
           }} // unit tests
-
-          stage('Build') {{
-            steps {{
-              sh 'python3 setup.py sdist bdist_wheel'
-            }}
-          }}
-
-          stage('Publish') {{
-            when {{ anyOf {{
-              expression {{ return params.FORCE_UPLOAD }}
-              expression {{
-                GITTAG=sh(returnStdout: true,
-                          script:'git describe --exact-match 2>/dev/null || true').trim()
-                LASTV=sh(returnStdout: true,
-                         script:'curl -s https://${{PYPI}}/pypi/`python setup.py --name`/json | jq -r .info.version || true').trim()
-                return ! (GITTAG in ['', 'v'+LASTV])
-                }}
-              }}
-            }}
-            steps {{
-              withCredentials([
-                 usernamePassword(credentialsId: "${{params.PYPI}}",
-                                  usernameVariable: 'TWINE_USERNAME',
-                                  passwordVariable: 'TWINE_PASSWORD')]) {{
-                sh '''
-                if [ -z "$PYPI_UPLOAD" ]; then PYPI_UPLOAD=$PYPI; fi
-                python3 -m twine upload --repository-url https://${{PYPI_UPLOAD}}/legacy/ dist/*
-                '''
-              }}
-            }}
-          }}
         }} // stages
 
         post {{
diff --git a/jobs/templates/swh-pypi.groovy b/jobs/templates/swh-pypi.groovy
new file mode 100644
--- /dev/null
+++ b/jobs/templates/swh-pypi.groovy
@@ -0,0 +1,64 @@
+pipeline {{
+  agent {{ label 'swh-tox' }}
+
+  stages {{
+    stage('Run tests') {{
+      agent none
+      steps {{
+        build(
+          job: '/{name}/tests',
+          parameters: [
+            string(name: 'REVISION', value: params.GIT_TAG),
+          ],
+          propagate: !params.IGNORE_TESTS,
+        )
+      }}
+    }}
+
+    stage('Checkout') {{
+      steps {{
+        checkout([$class: 'GitSCM',
+                  branches: [[name: params.GIT_TAG]],
+                  doGenerateSubmoduleConfigurations: false,
+                  extensions: [],
+                  gitTool: 'Default',
+                  submoduleCfg: [],
+                  userRemoteConfigs: [[url: 'https://forge.softwareheritage.org/source/{display-name}.git']]
+        ])
+      }}
+    }}
+
+    stage('Build') {{
+      steps {{
+        sh 'python3 setup.py sdist bdist_wheel'
+        archiveArtifacts allowEmptyArchive: true,
+          artifacts: 'dist/*',
+          fingerprint: true
+      }}
+    }}
+
+    stage('Publish') {{
+      when {{
+        anyOf {{
+          expression {{ return params.FORCE_UPLOAD }}
+          expression {{
+            LASTV=sh(returnStdout: true,
+                     script:'curl -s https://${{PYPI}}/pypi/`python setup.py --name`/json | jq -r .info.version || true').trim()
+            return 'v'+LASTV != params.GIT_TAG
+            }}
+        }}
+      }}
+      steps {{
+        withCredentials([
+          usernamePassword(credentialsId: "${{params.PYPI}}",
+                           usernameVariable: 'TWINE_USERNAME',
+                           passwordVariable: 'TWINE_PASSWORD')]) {{
+          sh '''
+            if [ -z "$PYPI_UPLOAD" ]; then PYPI_UPLOAD=$PYPI; fi
+            python3 -m twine upload --repository-url https://${{PYPI_UPLOAD}}/legacy/ dist/*
+          '''
+        }}
+      }}
+    }}
+  }}
+}}
diff --git a/jobs/templates/swh-pypi.yaml b/jobs/templates/swh-pypi.yaml
new file mode 100644
--- /dev/null
+++ b/jobs/templates/swh-pypi.yaml
@@ -0,0 +1,40 @@
+- job-template:
+    name: "{name}/pypi-upload"
+    display-name: "Upload to PyPI"
+    project-type: pipeline
+    sandbox: true
+    properties:
+      - build-discarder:
+          num-to-keep: 20
+    parameters:
+      - git-parameter:
+          name: GIT_TAG
+          description: git tag to process
+          type: PT_TAG
+          sortMode: DESCENDING_SMART
+          selectedValue: TOP
+      - string:
+          name: PYPI
+          description: |
+            PYPI registry to publish to when built revision is a tag. There
+            must exists a usernamePassword credential object with that name.
+            The pypi JSON API endpoint is built as https://$PYPI/project/<name>/json
+          default: test.pypi.org
+      - string:
+          name: PYPI_UPLOAD
+          description: |
+            PYPI upload base host. If unset, defaults to $PYPI. The upload endpoint is built as
+            https://$PYPI_UPLOAD/legacy/
+      - bool:
+          name: FORCE_UPLOAD
+          default: false
+          description: |
+            Force uploading python packages on the chosen PYPI registry, even if
+            the package already exists.
+      - bool:
+          name: IGNORE_TESTS
+          default: false
+          description: |
+            Proceed even if the tests are failing on the repository.
+    dsl:
+      !include-raw: swh-pypi.groovy