diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f8f4868..46e7345 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,11 +1,20 @@
 name: CI
 
+# Trigger policy: PR runs are the gate (incl. the version-hygiene merge guard
+# and the shim matrix); the post-merge main run verifies what actually landed
+# ("green main" for releases). Bare branch pushes trigger NOTHING — want CI
+# on a branch? Open the PR (draft if not ready).
 on:
   push:
-    branches: ["**"]
+    branches: [main]
   pull_request:
     branches: ["**"]
 
+# Rapid PR updates cancel the superseded in-progress run for the same ref.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   # WP-20: global checks run ONCE — they are version-independent (the
   # no-spark-imports gate covers every module in the reactor; the version-
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f98f21f..5faeb7d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -123,15 +123,17 @@ jobs:
       # Tests are NOT re-run here: releases cut only from green main (CI
       # already ran the full matrix on this commit). The version stamp is
       # workspace-only — main's dev-marker version is never committed.
+      # Passphrase flows via MAVEN_GPG_PASSPHRASE (the non-deprecated channel;
+      # -Dgpg.passphrase leaks into process args).
       - name: Stamp release version and deploy to Maven Central
         run: |
           mvn -B -q versions:set -DnewVersion="$VERSION" -DgenerateBackupPoms=false
-          mvn -B -Prelease clean deploy -DskipTests -Dgpg.passphrase="$GPG_PASSPHRASE"
+          mvn -B -Prelease clean deploy -DskipTests
         env:
           VERSION: ${{ needs.guard.outputs.version }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
           CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
       # The wheel must embed the SAME jars this run published to Central.
       - name: Upload bundle jars for the PyPI job
@@ -180,7 +182,9 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           name: interceptor-bundles
-          path: .
+          # upload-artifact strips the common ancestor (catalyst-interceptor/)
+          # from the zip; extracting here restores the bundle_jars.py glob paths
+          path: catalyst-interceptor
 
       - name: Rebuild bundle jars from the tagged source (pypi-only recovery)
         if: github.event_name == 'workflow_dispatch' && inputs.jobs == 'pypi-only'