diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fdf2a0e..e527aea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -205,6 +205,22 @@ jobs:
           # Imports the release key into the runner's keyring for the gpg plugin.
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
 
+      # Maven 3.10 (on ubuntu-latest since 2026-10-05) writes maven-metadata-local.xml and
+      # _remote.repositories into central-publishing-maven-plugin's staging directory; the plugin
+      # bundles them and Central rejects the bundle ("Bundle has content that does NOT have a
+      # .pom file"). Pin 3.9.16 for the publish until the plugin copes with 3.10:
+      # https://github.com/mavenplugins/central-publishing-maven-plugin/issues/78
+      - name: Use Maven 3.9.16
+        if: steps.check.outputs.skip != 'true'
+        run: |
+          version=3.9.16
+          curl -sSfL -o "$RUNNER_TEMP/maven.tar.gz" \
+            "https://repo1.maven.org/maven2/org/apache/maven/apache-maven/$version/apache-maven-$version-bin.tar.gz"
+          echo "831a8591fe20c8243b1dbe7d71e3244f31d1665b0804b2e825e38cbbe5ce0cafb8338851f90780735568773e0a6cd07bbec107cda0b896b008b861075358b6f6  $RUNNER_TEMP/maven.tar.gz" | sha512sum -c -
+          tar -xzf "$RUNNER_TEMP/maven.tar.gz" -C "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP/apache-maven-$version/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/apache-maven-$version/bin/mvn" -v
+
       - name: Release
         if: steps.check.outputs.skip != 'true'
         env: