diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 7e2e423..a91bc73 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -15,12 +15,16 @@ jobs:
       envx_version: ${{ env.ENVX_VERSION }}
       build: ${{ env.BUILD }}
     steps:
+      # release-please-config.json keeps releases draft until publish-release
+      # has every asset, so /releases/latest stays installable, and forces the
+      # tag immediately so the next changelog can find it.
       - name: Release Please
-        uses: GoogleCloudPlatform/release-please-action@v4
+        uses: googleapis/release-please-action@v4
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          release-type: rust
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
 
       - name: Set SemVer String
         id: set-semver
@@ -139,13 +143,14 @@ jobs:
             fi
           done
 
+      # gh finds draft releases by tag; the REST releases/tags/{tag} endpoint cannot.
       - name: Upload release archive
-        uses: softprops/action-gh-release@v1
+        shell: bash
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: v${{ needs.release-please.outputs.envx_version }}
-          files: envx-${{ needs.release-please.outputs.envx_version }}-${{ matrix.target }}*
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.release-please.outputs.envx_version }}
+          TARGET: ${{ matrix.target }}
+        run: gh release upload "v$VERSION" envx-"$VERSION"-"$TARGET"* --clobber --repo "$GITHUB_REPOSITORY"
 
       # - name: Install cargo-deb
       #   if: matrix.target == 'x86_64-unknown-linux-musl'
@@ -161,3 +166,23 @@ jobs:
       #   with:
       #     tag: ${{ needs.release-please.outputs.envx_version }}
       #     file: envx-${{ needs.release-please.outputs.envx_version }}-amd64.deb
+
+  # Skipped unless every build-release leg succeeded, leaving the draft
+  # unpublished. Recover with "Re-run failed jobs"; a full re-run does not
+  # re-emit release_created for an existing release.
+  publish-release:
+    name: Publish Release
+    needs: [release-please, build-release]
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      # make_latest=legacy picks latest by version and date, so a delayed
+      # older release cannot displace a newer one.
+      - name: Publish draft release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: v${{ needs.release-please.outputs.envx_version }}
+        run: |
+          id=$(gh release view "$TAG" --json databaseId --jq .databaseId --repo "$GITHUB_REPOSITORY")
+          gh api --method PATCH "repos/$GITHUB_REPOSITORY/releases/$id" -F draft=false -f make_latest=legacy
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 0000000..9a61761
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "2.17.0"
+}
diff --git a/release-please-config.json b/release-please-config.json
new file mode 100644
index 0000000..6460c15
--- /dev/null
+++ b/release-please-config.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "release-type": "rust",
+      "include-component-in-tag": false,
+      "draft": true,
+      "force-tag-creation": true
+    }
+  }
+}