diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 95116c2..f030ad6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,7 +28,10 @@ jobs:
         run: dotnet restore CodeArchitects.Platform.sln
 
       - name: Build
-        run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore
+        # -m:1 (single MSBuild node) serializes the build so multi-targeted
+        # ProjectReferences build in dependency order, avoiding an intermittent
+        # CS0006 "metadata file could not be found" race under parallel builds.
+        run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore -m:1
 
       - name: Test (unit & functional)
         shell: bash
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 40830cd..a18a0c7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,7 +22,11 @@ name: Publish packages
 #      (or `v7.1.0-rc.1`) publishes exactly that version.
 #
 # Requires repository secret NUGET_API_KEY (a NuGet.org API key with push rights
-# for the CodeArchitects.Platform.* package ids). Commit-back uses GITHUB_TOKEN.
+# for the CodeArchitects.Platform.* package ids). The commit-back + tag push is
+# authenticated with a GitHub App installation token (secrets
+# CODEARCHITECTS_RELEASE_BOT_APP_ID / CODEARCHITECTS_RELEASE_BOT_PRIVATE_KEY) so it
+# can bypass the branch ruleset that would otherwise require a pull request. The
+# built-in GITHUB_TOKEN cannot bypass that rule.
 
 on:
   release:
@@ -69,10 +73,18 @@ jobs:
     permissions:
       contents: write   # needed to commit the version bump and push the tag
     steps:
+      - name: Generate GitHub App token
+        id: app_token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CODEARCHITECTS_RELEASE_BOT_APP_ID }}
+          private-key: ${{ secrets.CODEARCHITECTS_RELEASE_BOT_PRIVATE_KEY }}
+
       - uses: actions/checkout@v4
         with:
+          # full history + GitHub App token to bypass branch protection rules
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app_token.outputs.token }}
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
@@ -106,7 +118,9 @@ jobs:
         run: dotnet restore CodeArchitects.Platform.sln
 
       - name: Build
-        run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore -p:Version=${{ steps.meta.outputs.version }}
+        # -m:1 serializes the build to avoid an intermittent CS0006 race between
+        # multi-targeted ProjectReferences (see ci.yml for details).
+        run: dotnet build CodeArchitects.Platform.sln --configuration Release --no-restore -m:1 -p:Version=${{ steps.meta.outputs.version }}
 
       - name: Pack (all packable projects under src/)
         shell: bash