diff --git a/.github/actions/commit-release-metadata/action.yml b/.github/actions/commit-release-metadata/action.yml
index 0a5bee8..8b3303b 100644
--- a/.github/actions/commit-release-metadata/action.yml
+++ b/.github/actions/commit-release-metadata/action.yml
@@ -8,12 +8,9 @@ inputs:
     description: Path to the module manifest to include in the commit.
     required: true
   github-token:
-    description: Default GITHUB_TOKEN, used when no release bot token is configured.
-    required: true
   release-bot-token:
-    description: Optional token used when branch protection blocks GITHUB_TOKEN pushes.
-    required: false
-    default: ''
+    description: GitHub App or fine-grained token that pushes metadata and triggers CI.
+    required: true
   branch:
     description: Branch to push the release metadata commit to.
     required: false
@@ -26,20 +23,14 @@ runs:
       env:
         RELEASE_TAG: ${{ inputs.release-tag }}
         MANIFEST_PATH: ${{ inputs.manifest-path }}
-        GITHUB_TOKEN: ${{ inputs.github-token }}
         RELEASE_BOT_TOKEN: ${{ inputs.release-bot-token }}
         TARGET_BRANCH: ${{ inputs.branch }}
       run: |
         set -euo pipefail
 
-        push_token="${RELEASE_BOT_TOKEN:-${GITHUB_TOKEN:-}}"
-        if [ -z "${push_token}" ]; then
-          echo "::error::No token available for pushing release metadata."
-          exit 1
-        fi
-
         if [ -z "${RELEASE_BOT_TOKEN:-}" ]; then
-          echo "::notice::ATLASSIANPS_RELEASE_BOT_TOKEN is not configured. Falling back to GITHUB_TOKEN."
+          echo "::error::A GitHub App or fine-grained release bot token is required to push metadata and trigger CI."
+          exit 1
         fi
 
         if git diff --quiet -- CHANGELOG.md .changelog "${MANIFEST_PATH}"; then
@@ -52,9 +43,4 @@ runs:
         git add CHANGELOG.md .changelog "${MANIFEST_PATH}"
         git commit -m "Prepare ${RELEASE_TAG} release"
 
-        if ! git push "https://x-access-token:${push_token}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${TARGET_BRANCH}"; then
-          if [ -z "${RELEASE_BOT_TOKEN:-}" ]; then
-            echo "::error::Push with GITHUB_TOKEN failed. Configure ATLASSIANPS_RELEASE_BOT_TOKEN when branch protection prevents direct pushes."
-          fi
-          exit 1
-        fi
+        git push "https://x-access-token:${RELEASE_BOT_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${TARGET_BRANCH}"
diff --git a/.github/actions/create-release-tag/action.yml b/.github/actions/create-release-tag/action.yml
index 482a7be..1d051d2 100644
--- a/.github/actions/create-release-tag/action.yml
+++ b/.github/actions/create-release-tag/action.yml
@@ -1,9 +1,16 @@
 name: Create Release Tag
-description: Create and push an annotated release tag, skipping if it already exists.
+description: Create and push an annotated release tag, or verify an existing tag identifies expected commit.
 inputs:
   tag:
     description: Annotated tag to create, for example v1.2.3.
     required: true
+  commit:
+    description: Commit the tag must identify. Defaults to current checkout commit.
+    required: false
+    default: HEAD
+  github-token:
+    description: GitHub App or fine-grained token that creates the release tag.
+    required: true
 runs:
   using: composite
   steps:
@@ -11,15 +18,23 @@ runs:
       shell: bash
       env:
         RELEASE_TAG: ${{ inputs.tag }}
+        RELEASE_COMMIT: ${{ inputs.commit }}
+        RELEASE_BOT_TOKEN: ${{ inputs.github-token }}
       run: |
         set -euo pipefail
 
         git config user.name "github-actions[bot]"
         git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
+        expected_commit="$(git rev-parse "${RELEASE_COMMIT}^{commit}")"
         if git show-ref --verify --quiet "refs/tags/${RELEASE_TAG}"; then
-          echo "Release tag ${RELEASE_TAG} already exists."
+          tag_commit="$(git rev-parse "${RELEASE_TAG}^{commit}")"
+          if [ "${tag_commit}" != "${expected_commit}" ]; then
+            echo "::error::Release tag ${RELEASE_TAG} identifies ${tag_commit}, not expected ${expected_commit}."
+            exit 1
+          fi
+          echo "Release tag ${RELEASE_TAG} already identifies expected commit ${expected_commit}."
         else
-          git tag -a "${RELEASE_TAG}" -m "${RELEASE_TAG}"
-          git push origin "refs/tags/${RELEASE_TAG}"
+          git tag -a "${RELEASE_TAG}" "${expected_commit}" -m "${RELEASE_TAG}"
+          git push "https://x-access-token:${RELEASE_BOT_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "refs/tags/${RELEASE_TAG}"
         fi
diff --git a/.github/actions/plan-merged-release/action.yml b/.github/actions/plan-merged-release/action.yml
index 6737dd2..2027314 100644
--- a/.github/actions/plan-merged-release/action.yml
+++ b/.github/actions/plan-merged-release/action.yml
@@ -1,11 +1,11 @@
 name: Plan Merged Release
-description: Resolve release intent from the pull request associated with a merged commit and compute the next release tag.
+description: Reconcile merged pull request intent since the latest release tag and compute the next release tag.
 inputs:
   github-token:
     description: Token used to read merged pull request metadata.
     required: false
   commit-sha:
-    description: Merge commit SHA to inspect. Defaults to github.sha.
+    description: Master commit SHA through which release intent is reconciled. Defaults to github.sha.
     required: false
   changelog-directory:
     description: Directory containing changelog fragments.
diff --git a/.github/actions/plan-merged-release/plan-merged-release.ps1 b/.github/actions/plan-merged-release/plan-merged-release.ps1
index 7aef313..b34b121 100644
--- a/.github/actions/plan-merged-release/plan-merged-release.ps1
+++ b/.github/actions/plan-merged-release/plan-merged-release.ps1
@@ -43,75 +43,89 @@ if ($isManualRelease) {
     $releaseImpact = $manualReleaseImpact
     Write-OutputValue -Name release_impact -Value $releaseImpact
 }
-else {
-    if (-not $env:COMMIT_SHA) {
-        throw 'plan-merged-release requires COMMIT_SHA. Run it from a push workflow or pass commit-sha.'
-    }
-
-    $commitPullsRoute = 'repos/{0}/commits/{1}/pulls' -f $env:GITHUB_REPOSITORY, $env:COMMIT_SHA
-    $pullRequestJson = gh api $commitPullsRoute --jq '.[] | select(.merged_at != null) | { number, title, user: .user.login }' |
-        Select-Object -First 1
-
-    if (-not $pullRequestJson) {
-        Write-OutputValue -Name should_release -Value 'false'
-        Write-OutputValue -Name skip_reason -Value 'no associated merged pull request'
-        Write-Host "Skipping release: no associated merged pull request for commit '$env:COMMIT_SHA'."
-        return
-    }
-
-    $pullRequest = $pullRequestJson | ConvertFrom-Json
-    $prNumber = [String]$pullRequest.number
-    $prTitle = [String]$pullRequest.title
-    $prAuthor = [String]$pullRequest.user
-
-    $labelsRoute = 'repos/{0}/issues/{1}/labels' -f $env:GITHUB_REPOSITORY, $prNumber
-    $labels = @(gh api $labelsRoute --paginate --jq '.[].name')
-    Write-OutputValue -Name pr_number -Value $prNumber
-    Write-OutputValue -Name pr_title -Value $prTitle
-    Write-OutputValue -Name pr_author -Value $prAuthor
-
-    $changelogDirectory = if ($env:CHANGELOG_DIRECTORY) { $env:CHANGELOG_DIRECTORY.TrimEnd('/') } else { '.changelog' }
-    $fragmentPattern = '^{0}/{1}\.(?<impact>patch|minor|major)\.(?<type>added|changed|fixed|removed|deprecated|security|breaking)\.md$' -f [Regex]::Escape($changelogDirectory), $prNumber
-    $fragmentFiles = @(
-        if (Test-Path -LiteralPath $changelogDirectory -PathType Container) {
-            Get-ChildItem -LiteralPath $changelogDirectory -Filter "$prNumber.*.md" |
-                ForEach-Object { Join-Path -Path $changelogDirectory -ChildPath $_.Name }
-        }
-    )
-    $matchingFragments = @(
-        foreach ($path in $fragmentFiles) {
-            $normalizedPath = $path -replace '\\', '/'
-            $match = [Regex]::Match($normalizedPath, $fragmentPattern)
-            if ($match.Success) {
-                [PSCustomObject]@{
-                    Path   = $normalizedPath
-                    Impact = $match.Groups['impact'].Value
-                    Type   = $match.Groups['type'].Value
-                }
-            }
-        }
-    )
-    foreach ($path in @($fragmentFiles | Where-Object { -not [Regex]::IsMatch(($_ -replace '\\', '/'), $fragmentPattern) })) {
-        throw "Changelog fragment '$path' must be named '$changelogDirectory/$prNumber.<patch|minor|major>.<added|changed|fixed|removed|deprecated|security|breaking>.md'."
-    }
-    $intentState = Resolve-ReleaseIntentState -Labels $labels -Fragments $matchingFragments -HasChangelogFilesForNone ($fragmentFiles.Count -gt 0) -Context "merged PR #$prNumber"
-    if (-not $intentState.IsValid) {
-        throw ($intentState.Messages -join [Environment]::NewLine)
-    }
-
-    $releaseImpact = $intentState.ReleaseImpact
-    Write-OutputValue -Name release_impact -Value $releaseImpact
-    if ($releaseImpact -eq 'none') {
-        Write-OutputValue -Name should_release -Value 'false'
-        Write-OutputValue -Name skip_reason -Value 'release:none'
-        Write-Host "Skipping release: merged PR #$prNumber has release:none."
-        return
-    }
-
-    $fragment = $intentState.Fragment
-    $changelogType = $intentState.ChangelogType
-    Write-OutputValue -Name changelog_type -Value $changelogType
-}
+else {
+    if (-not $env:COMMIT_SHA) {
+        throw 'plan-merged-release requires COMMIT_SHA. Run it from a push workflow or pass commit-sha.'
+    }
+
+    $changelogDirectory = if ($env:CHANGELOG_DIRECTORY) { $env:CHANGELOG_DIRECTORY.TrimEnd('/') } else { '.changelog' }
+    $stableTags = @(git tag --merged $env:COMMIT_SHA --list 'v[0-9]*' | Where-Object { $_ -match '^v\d+\.\d+\.\d+$' })
+    $latestStableTag = $stableTags | Sort-Object { [Version]($_.Substring(1)) } -Descending | Select-Object -First 1
+    $commits = if ($latestStableTag) {
+        @(git rev-list "$latestStableTag..$env:COMMIT_SHA")
+    }
+    else {
+        @(git rev-list $env:COMMIT_SHA)
+    }
+
+    $pullRequestsByNumber = @{}
+    foreach ($commit in $commits) {
+        $route = 'repos/{0}/commits/{1}/pulls' -f $env:GITHUB_REPOSITORY, $commit
+        foreach ($pullRequest in @(gh api $route | ConvertFrom-Json | Where-Object { $_.merged_at })) {
+            $pullRequestsByNumber[[String]$pullRequest.number] = $pullRequest
+        }
+    }
+
+    if ($pullRequestsByNumber.Count -eq 0) {
+        Write-OutputValue -Name should_release -Value 'false'
+        Write-OutputValue -Name skip_reason -Value 'no merged pull requests since latest release tag'
+        Write-Host "Skipping release: no merged pull requests found since '$latestStableTag'."
+        return
+    }
+
+    $impactRank = @{ none = 0; patch = 1; minor = 2; major = 3 }
+    $selectedImpact = 'none'
+    foreach ($pullRequest in @($pullRequestsByNumber.Values | Sort-Object { [Int]$_.number })) {
+        $prNumber = [String]$pullRequest.number
+        $prTitle = [String]$pullRequest.title
+        $prAuthor = [String]$pullRequest.user.login
+        $labelsRoute = 'repos/{0}/issues/{1}/labels' -f $env:GITHUB_REPOSITORY, $prNumber
+        $labels = @(gh api $labelsRoute --paginate --jq '.[].name')
+        $fragmentPattern = '^{0}/{1}\.(?<impact>patch|minor|major)\.(?<type>added|changed|fixed|removed|deprecated|security|breaking)\.md$' -f [Regex]::Escape($changelogDirectory), $prNumber
+        $fragmentFiles = @(
+            if (Test-Path -LiteralPath $changelogDirectory -PathType Container) {
+                Get-ChildItem -LiteralPath $changelogDirectory -Filter "$prNumber.*.md" |
+                    ForEach-Object { Join-Path -Path $changelogDirectory -ChildPath $_.Name }
+            }
+        )
+        $matchingFragments = @(
+            foreach ($path in $fragmentFiles) {
+                $normalizedPath = $path -replace '\\', '/'
+                $match = [Regex]::Match($normalizedPath, $fragmentPattern)
+                if ($match.Success) {
+                    [PSCustomObject]@{ Path = $normalizedPath; Impact = $match.Groups['impact'].Value; Type = $match.Groups['type'].Value }
+                }
+            }
+        )
+        foreach ($path in @($fragmentFiles | Where-Object { -not [Regex]::IsMatch(($_ -replace '\\', '/'), $fragmentPattern) })) {
+            throw "Changelog fragment '$path' must be named '$changelogDirectory/$prNumber.<patch|minor|major>.<added|changed|fixed|removed|deprecated|security|breaking>.md'."
+        }
+        $intentState = Resolve-ReleaseIntentState -Labels $labels -Fragments $matchingFragments -HasChangelogFilesForNone ($fragmentFiles.Count -gt 0) -Context "merged PR #$prNumber"
+        if (-not $intentState.IsValid) {
+            throw ($intentState.Messages -join [Environment]::NewLine)
+        }
+        if ($intentState.ReleaseImpact -eq 'none') {
+            continue
+        }
+        if ($impactRank[$intentState.ReleaseImpact] -gt $impactRank[$selectedImpact]) {
+            $selectedImpact = $intentState.ReleaseImpact
+        }
+        if (-not $intentState.Fragment) {
+            $fragmentPath = Join-Path -Path $changelogDirectory -ChildPath ('{0}.{1}.{2}.md' -f $prNumber, $intentState.ReleaseImpact, $intentState.ChangelogType)
+            New-Item -Path (Split-Path -Path $fragmentPath -Parent) -ItemType Directory -Force | Out-Null
+            ('* {0} (#{1}, @{2})' -f ($prTitle -replace "`r`n|`r|`n", ' '), $prNumber, $prAuthor) | Set-Content -LiteralPath $fragmentPath -Encoding utf8
+        }
+    }
+
+    $releaseImpact = $selectedImpact
+    Write-OutputValue -Name release_impact -Value $releaseImpact
+    if ($releaseImpact -eq 'none') {
+        Write-OutputValue -Name should_release -Value 'false'
+        Write-OutputValue -Name skip_reason -Value 'release:none'
+        Write-Host 'Skipping release: all merged pull requests since latest release tag have release:none.'
+        return
+    }
+}
 
 $versions = @(
     git tag --list 'v[0-9]*' |
diff --git a/.github/actions/setup-powershell/action.yml b/.github/actions/setup-powershell/action.yml
index 7c89826..2a9550f 100644
--- a/.github/actions/setup-powershell/action.yml
+++ b/.github/actions/setup-powershell/action.yml
@@ -16,7 +16,7 @@ runs:
   using: composite
   steps:
     - name: Cache PowerShell modules
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: |
           ~/.local/share/powershell/Modules
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d47690b..6f99700 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ concurrency:
 on:
   pull_request:
     branches: [master]
-    paths-ignore: &paths-ignore
+    paths-ignore:
       - "CHANGELOG.md"
       - "LICENSE"
       # AI assistant instruction files
@@ -27,15 +27,17 @@ on:
       - ".spelling"
   push:
     branches: [master]
-    paths-ignore: *paths-ignore
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: ./.github/actions/setup-powershell
 
       - run: Invoke-Build -Task Lint
@@ -46,14 +48,14 @@ jobs:
     needs: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: ./.github/actions/setup-powershell
 
       - run: Invoke-Build -File ./AtlassianPS.Standards.build.ps1 -Task Build
         shell: pwsh
 
       - name: Upload release artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: Release
           path: ./Release/
@@ -63,7 +65,7 @@ jobs:
     needs: build
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: ./.github/actions/setup-powershell
         with:
           ps-version: "5"
@@ -71,7 +73,7 @@ jobs:
           # so the Windows PowerShell module path is populated.
           skip-setup: "true"
 
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: Release
           path: ./Release/
@@ -85,7 +87,7 @@ jobs:
       - run: Invoke-Build -Task Test
         shell: powershell
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: always()
         with:
           name: Windows-PS5-Unit-Tests
@@ -103,10 +105,10 @@ jobs:
           - { os: ubuntu-latest, name: "Ubuntu" }
           - { os: macos-latest, name: "macOS" }
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: ./.github/actions/setup-powershell
 
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: Release
           path: ./Release/
@@ -114,7 +116,7 @@ jobs:
       - run: Invoke-Build -Task Test
         shell: pwsh
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: always()
         with:
           name: ${{ matrix.name }}-Unit-Tests
diff --git a/.github/workflows/continuous_release.yml b/.github/workflows/continuous_release.yml
index 1d00c58..666b80d 100644
--- a/.github/workflows/continuous_release.yml
+++ b/.github/workflows/continuous_release.yml
@@ -8,7 +8,7 @@ on:
     inputs:
       release_impact:
         description: Release impact for unreleased changes already on master
-        required: true
+        required: false
         type: choice
         options:
           - patch
@@ -18,6 +18,10 @@ on:
         description: Optional prerelease label for unreleased changes already on master, for example alpha, beta, rc, or rc-2
         required: false
         type: string
+      recovery_tag:
+        description: Existing release tag to recover after a partial publish, for example v1.2.3
+        required: false
+        type: string
 
 concurrency:
   group: continuous-release
@@ -32,13 +36,14 @@ jobs:
   prepare:
     name: Prepare release metadata
     if: >-
-      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'workflow_dispatch' && inputs.recovery_tag == '') ||
       (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'master' &&
       !startsWith(github.event.workflow_run.head_commit.message, 'Prepare v'))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'workflow_dispatch' && 'master' || github.event.workflow_run.head_sha }}
@@ -50,16 +55,6 @@ jobs:
           release-impact: ${{ github.event_name == 'workflow_dispatch' && inputs.release_impact || '' }}
           prerelease-label: ${{ github.event_name == 'workflow_dispatch' && inputs.prerelease || '' }}
 
-      - name: Create generated changelog fragment
-        if: steps.plan.outputs.should_release == 'true' && steps.plan.outputs.fragment_path != ''
-        shell: pwsh
-        env:
-          FRAGMENT_PATH: ${{ steps.plan.outputs.fragment_path }}
-          FRAGMENT_CONTENT: ${{ steps.plan.outputs.fragment_content }}
-        run: |
-          New-Item -Path (Split-Path -Path $env:FRAGMENT_PATH -Parent) -ItemType Directory -Force | Out-Null
-          $env:FRAGMENT_CONTENT | Set-Content -LiteralPath $env:FRAGMENT_PATH -Encoding utf8
-
       - uses: ./.github/actions/prepare-release-changelog
         if: steps.plan.outputs.should_release == 'true'
         with:
@@ -78,74 +73,139 @@ jobs:
         with:
           release-tag: ${{ steps.plan.outputs.release_tag }}
           manifest-path: AtlassianPS.Standards/AtlassianPS.Standards.psd1
-          github-token: ${{ github.token }}
           release-bot-token: ${{ secrets.ATLASSIANPS_RELEASE_BOT_TOKEN }}
 
   publish:
     name: Publish tested release artifact
     if: >-
-      github.event_name == 'workflow_run' &&
+      (github.event_name == 'workflow_run' &&
       github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'master' &&
       startsWith(github.event.workflow_run.head_commit.message, 'Prepare v') &&
-      github.event.workflow_run.head_commit.author.name == 'github-actions[bot]'
+      github.event.workflow_run.head_commit.author.name == 'github-actions[bot]') ||
+      (github.event_name == 'workflow_dispatch' && inputs.recovery_tag != '')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
-          ref: ${{ github.event.workflow_run.head_sha }}
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || inputs.recovery_tag }}
 
       - name: Resolve prepared release
         id: prepared_release
         shell: pwsh
+        env:
+          RECOVERY_TAG: ${{ inputs.recovery_tag }}
+          PREPARED_COMMIT_MESSAGE: ${{ github.event.workflow_run.head_commit.message }}
         run: |
-          $message = '${{ github.event.workflow_run.head_commit.message }}'
+          if ($env:RECOVERY_TAG) {
+            if ($env:RECOVERY_TAG -notmatch '^v\d+\.\d+\.\d+(?:-(?:alpha|beta|rc)(?:-\d+)?)?$') {
+              throw "Recovery tag '$env:RECOVERY_TAG' is not a supported release tag."
+            }
+            $tagCommit = git rev-parse "$env:RECOVERY_TAG^{commit}"
+            git merge-base --is-ancestor $tagCommit origin/master
+            if ($LASTEXITCODE -ne 0) {
+              throw "Recovery tag '$env:RECOVERY_TAG' does not identify a commit reachable from master."
+            }
+            "release_tag=$env:RECOVERY_TAG" >> $env:GITHUB_OUTPUT
+            "release_commit=$tagCommit" >> $env:GITHUB_OUTPUT
+            return
+          }
+
+          $message = $env:PREPARED_COMMIT_MESSAGE
           if ($message -notmatch '^Prepare (?<tag>v\d+\.\d+\.\d+(?:-(?:alpha|beta|rc)(?:-\d+)?)?) release$') {
-              throw "Commit message '$message' is not a release metadata commit."
+            throw "Commit message '$message' is not a release metadata commit."
           }
 
           "release_tag=$($Matches.tag)" >> $env:GITHUB_OUTPUT
+          "release_commit=${{ github.event.workflow_run.head_sha }}" >> $env:GITHUB_OUTPUT
+
+      - name: Resolve tested CI artifact
+        id: ci_run
+        shell: pwsh
+        env:
+          WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
+          RELEASE_COMMIT: ${{ steps.prepared_release.outputs.release_commit }}
+        run: |
+          if ($env:WORKFLOW_RUN_ID) {
+            "run_id=$env:WORKFLOW_RUN_ID" >> $env:GITHUB_OUTPUT
+            return
+          }
+
+          $runId = gh api "repos/$env:GITHUB_REPOSITORY/actions/runs?head_sha=$env:RELEASE_COMMIT&status=completed&per_page=100" --jq '.workflow_runs[] | select(.name == "CI" and .conclusion == "success") | .id' |
+              Select-Object -First 1
+          if (-not $runId) {
+            throw "No successful CI run was found for recovery commit '$env:RELEASE_COMMIT'."
+          }
+          "run_id=$runId" >> $env:GITHUB_OUTPUT
 
       - name: Download tested release artifact
-        uses: dawidd6/action-download-artifact@v21
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
         with:
-          run_id: ${{ github.event.workflow_run.id }}
+          run_id: ${{ steps.ci_run.outputs.run_id }}
           name: Release
           path: ./Release/
           if_no_artifact_found: fail
 
       - uses: ./.github/actions/setup-powershell
 
-      - uses: ./.github/actions/create-release-tag
-        with:
-          tag: ${{ steps.prepared_release.outputs.release_tag }}
-
-      - uses: ./.github/actions/resolve-release-tag
-        id: release_ref
-        with:
-          tag: ${{ steps.prepared_release.outputs.release_tag }}
-
       - uses: ./.github/actions/build-release-notes
         id: release_notes
         with:
-          release-version: ${{ steps.release_ref.outputs.release_tag }}
+          release-version: ${{ steps.prepared_release.outputs.release_tag }}
           module-path: ./AtlassianPS.Standards/AtlassianPS.Standards.psd1
 
       - name: Stamp and verify release artifact
-        run: Invoke-Build -Task SetVersion -VersionToPublish ${{ steps.release_ref.outputs.release_tag }} -VerifyPublishedRelease
+        env:
+          RECOVERY_TAG: ${{ inputs.recovery_tag }}
+        run: |
+          if ($env:RECOVERY_TAG) {
+            Invoke-Build -Task SetVersion -VersionToPublish ${{ steps.prepared_release.outputs.release_tag }}
+          }
+          else {
+            Invoke-Build -Task SetVersion -VersionToPublish ${{ steps.prepared_release.outputs.release_tag }} -VerifyPublishedRelease
+          }
         shell: pwsh
 
       - name: Package release artifact
         run: Invoke-Build -Task Package
         shell: pwsh
 
+      - name: Verify release artifact
+        run: Invoke-Build -Task VerifyReleaseArtifact -VersionToPublish ${{ steps.prepared_release.outputs.release_tag }}
+        shell: pwsh
+
+      - uses: ./.github/actions/create-release-tag
+        with:
+          tag: ${{ steps.prepared_release.outputs.release_tag }}
+          commit: ${{ steps.prepared_release.outputs.release_commit }}
+          github-token: ${{ secrets.ATLASSIANPS_RELEASE_BOT_TOKEN }}
+
+      - uses: ./.github/actions/resolve-release-tag
+        id: release_ref
+        with:
+          tag: ${{ steps.prepared_release.outputs.release_tag }}
+
       - name: Publish tested module artifact
-        run: Publish-Module -Path ./Release/AtlassianPS.Standards -NuGetApiKey ${{ secrets.PSGALLERY_API_KEY }} -ErrorAction Stop
+        run: |
+          $manifest = Test-ModuleManifest -Path ./Release/AtlassianPS.Standards/AtlassianPS.Standards.psd1 -ErrorAction Stop
+          $prerelease = [String]$manifest.PrivateData.PSData.Prerelease
+          $expectedGalleryVersion = if ($prerelease) { "$($manifest.Version)-$prerelease" } else { [String]$manifest.Version }
+          $published = Find-Module -Name $manifest.Name -AllVersions -AllowPrerelease -ErrorAction Stop |
+            Where-Object {
+                  $_.Version.ToString() -eq $expectedGalleryVersion
+              } |
+              Select-Object -First 1
+          if ($published) {
+            Write-Host "PSGallery already contains $($manifest.Name) $expectedGalleryVersion; skipping immutable publish."
+            return
+          }
+          Publish-Module -Path ./Release/AtlassianPS.Standards -NuGetApiKey ${{ secrets.PSGALLERY_API_KEY }} -ErrorAction Stop
         shell: pwsh
 
       - name: Create GitHub release and upload asset
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           tag_name: ${{ steps.release_ref.outputs.release_tag }}
           name: ${{ steps.release_ref.outputs.release_tag }}
@@ -159,7 +219,7 @@ jobs:
 
       - name: Notify homepage to update submodule
         if: ${{ !contains(steps.release_ref.outputs.release_tag, '-alpha') && !contains(steps.release_ref.outputs.release_tag, '-beta') && !contains(steps.release_ref.outputs.release_tag, '-rc') }}
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
         with:
           token: ${{ secrets.HOMEPAGE_PAT }}
           repository: AtlassianPS/AtlassianPS.github.io
diff --git a/.github/workflows/release_intent.yml b/.github/workflows/release_intent.yml
index b50ccf7..0603e4e 100644
--- a/.github/workflows/release_intent.yml
+++ b/.github/workflows/release_intent.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout trusted base
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           ref: ${{ github.event.pull_request.base.ref }}
 
diff --git a/AGENTS.md b/AGENTS.md
index 88b4c00..9350ca1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -34,6 +34,9 @@ If guidance conflicts, follow this file first.
 - Pull requests should declare release intent with exactly one `release:*` label; user-facing changes also need a `changelog:*` label or a valid `.changelog/<pr-number>.<impact>.<type>.md` fragment.
 - Do not ask contributors to choose the final release version in normal PRs; release preparation batches merged intent later.
 - Keep release notes sourced from one `CHANGELOG.md` section for both GitHub releases and PSGallery manifest `PrivateData.PSData.ReleaseNotes`.
+- `ATLASSIANPS_RELEASE_BOT_TOKEN` must be a GitHub App or fine-grained token. `GITHUB_TOKEN` cannot start follow-up CI after metadata push.
+- Do not enable release publishing on an unprotected `master`; direct pushes can bypass review and imitate release metadata.
+- For a partial release with existing tag, follow `docs/ReleaseBlueprint.md` "Recovery Runbook". Do not delete/recreate tag or republish PSGallery version.
 - When changing release behavior, update `docs/ReleaseBlueprint.md`, `docs/BlueprintHelpers.md`, tests, and these agent instructions together.
 
 ## Build, Lint, Test (run from repo root)
@@ -74,4 +77,4 @@ Before finalizing, always run the full pipeline: `Invoke-Build -Task Lint, Build
 ## CI/CD Notes
 
 - `.github/workflows/ci.yml` is the required quality gate for runtime/code changes.
-- Instruction-only changes can be skipped by CI path filters; run local validation and report exact command outcomes.
+- CI path filters may skip pull request validation for documentation and metadata-only changes. CI always runs for `master` pushes so every merged release-labelled change reaches release planning.
diff --git a/AtlassianPS.Standards.build.ps1 b/AtlassianPS.Standards.build.ps1
index 87c2a99..f5af1a9 100644
--- a/AtlassianPS.Standards.build.ps1
+++ b/AtlassianPS.Standards.build.ps1
@@ -155,13 +155,29 @@ Task SetVersion {
 }
 
 # Synopsis: Compress the built module into the publishable release artifact
-Task Package {
+Task Package {
     $script:PackagePath = New-AtlassianPSModulePackage `
         -BuildOutputPath $env:BHBuildOutput `
         -ModuleName $env:BHProjectName
-}
-
-Task TestPublish Build, Package, {
+}
+
+Task VerifyReleaseArtifact Package, {
+    if (-not $script:BuildInfo.VersionToPublish) {
+        throw 'VersionToPublish is required for VerifyReleaseArtifact. Use -VersionToPublish <semver>.'
+    }
+
+    $expectedCore = $script:BuildInfo.VersionToPublish -replace '-.*$', ''
+    $expectedPrerelease = if ($script:BuildInfo.VersionToPublish -match '-(?<label>.+)$') { $Matches.label } else { '' }
+    $null = Test-AtlassianPSModulePackage `
+        -BuildOutputPath $env:BHBuildOutput `
+        -ModuleName $env:BHProjectName `
+        -PackagePath $script:PackagePath `
+        -ExpectedVersion $expectedCore `
+        -ExpectedPrerelease $expectedPrerelease `
+        -RequireReleaseNotes
+}
+
+Task TestPublish Build, Package, {
     $null = Test-AtlassianPSModulePackage `
         -BuildOutputPath $env:BHBuildOutput `
         -ModuleName $env:BHProjectName `
diff --git a/AtlassianPS.Standards/Private/Import-PesterVersion.ps1 b/AtlassianPS.Standards/Private/Import-PesterVersion.ps1
index cafc851..f315c6b 100644
--- a/AtlassianPS.Standards/Private/Import-PesterVersion.ps1
+++ b/AtlassianPS.Standards/Private/Import-PesterVersion.ps1
@@ -10,13 +10,13 @@
     )
 
     $pesterVersionToUse = Get-UsablePesterVersion -MinimumVersion $MinimumVersion -MaximumVersion $MaximumVersion
-    $loadedPester = Get-Module -Name 'Pester' | Sort-Object -Property Version -Descending | Select-Object -First 1
-    if ((-not $loadedPester) -or ($loadedPester.Version -ne $pesterVersionToUse)) {
-        if ($loadedPester) {
-            Get-Module -Name 'Pester' | Remove-Module -Force -ErrorAction SilentlyContinue
-        }
-        Import-Module -Name 'Pester' -RequiredVersion $pesterVersionToUse -ErrorAction Stop
-    }
+    $loadedPester = Get-Module -Name 'Pester' | Sort-Object -Property Version -Descending | Select-Object -First 1
+    if ($loadedPester -and $loadedPester.Version -ne $pesterVersionToUse) {
+        Get-Module -Name 'Pester' | Remove-Module -Force -ErrorAction SilentlyContinue
+    }
+    # Pester test scripts execute outside this module scope. Import globally even when the
+    # selected version is already module-scoped so its commands remain available on Linux.
+    Import-Module -Name 'Pester' -RequiredVersion $pesterVersionToUse -Global -ErrorAction Stop
 
     return $pesterVersionToUse
 }
diff --git a/AtlassianPS.Standards/Public/Test-ModulePackage.ps1 b/AtlassianPS.Standards/Public/Test-ModulePackage.ps1
index ef5fe69..b3b543c 100644
--- a/AtlassianPS.Standards/Public/Test-ModulePackage.ps1
+++ b/AtlassianPS.Standards/Public/Test-ModulePackage.ps1
@@ -15,8 +15,17 @@
     .PARAMETER ModuleName
         Name of the module directory and manifest to validate.
 
-    .PARAMETER PackagePath
-        Optional explicit package archive path. Defaults to <BuildOutputPath>/<ModuleName>.zip.
+    .PARAMETER PackagePath
+        Optional explicit package archive path. Defaults to <BuildOutputPath>/<ModuleName>.zip.
+
+    .PARAMETER ExpectedVersion
+        Optional expected numeric module version.
+
+    .PARAMETER RequireReleaseNotes
+        Require non-empty PrivateData.PSData.ReleaseNotes in both release manifest and package.
+
+    .PARAMETER ExpectedPrerelease
+        Optional prerelease label expected in PrivateData.PSData.Prerelease.
 
     .OUTPUTS
         PSCustomObject with ModulePath, ManifestPath, PackagePath, Name, and Version.
@@ -37,8 +46,18 @@
         [ValidateNotNullOrEmpty()]
         [String]$ModuleName,
 
-        [Parameter()]
-        [String]$PackagePath
+        [Parameter()]
+        [String]$PackagePath,
+
+        [Parameter()]
+        [String]$ExpectedVersion,
+
+        [Parameter()]
+        [Switch]$RequireReleaseNotes,
+
+        [Parameter()]
+        [AllowEmptyString()]
+        [String]$ExpectedPrerelease
     )
 
     $releaseModulePath = Join-Path -Path $BuildOutputPath -ChildPath $ModuleName
@@ -61,9 +80,19 @@
     if ($manifest.Name -ne $ModuleName) {
         throw "Release manifest name '$($manifest.Name)' does not match '$ModuleName'."
     }
-    if ($null -eq $manifest.Version) {
-        throw 'Release manifest version could not be resolved.'
-    }
+    if ($null -eq $manifest.Version) {
+        throw 'Release manifest version could not be resolved.'
+    }
+    if ($ExpectedVersion -and $manifest.Version.ToString() -ne $ExpectedVersion) {
+        throw "Release manifest version '$($manifest.Version)' does not match expected '$ExpectedVersion'."
+    }
+    $manifestData = Import-PowerShellDataFile -LiteralPath $releaseManifestPath
+    if ($RequireReleaseNotes -and [String]::IsNullOrWhiteSpace($manifestData.PrivateData.PSData.ReleaseNotes)) {
+        throw 'Release manifest release notes are empty.'
+    }
+    if ($PSBoundParameters.ContainsKey('ExpectedPrerelease') -and $manifestData.PrivateData.PSData.Prerelease -ne $ExpectedPrerelease) {
+        throw "Release manifest prerelease '$($manifestData.PrivateData.PSData.Prerelease)' does not match expected '$ExpectedPrerelease'."
+    }
 
     $packageValidationRoot = Join-Path -Path ([System.IO.Path]::GetTempPath()) -ChildPath "AtlassianPS-PackageValidation-$([Guid]::NewGuid().ToString('N'))"
     try {
@@ -78,9 +107,16 @@
         if ($packagedManifest.Name -ne $ModuleName) {
             throw "Packaged manifest name '$($packagedManifest.Name)' does not match '$ModuleName'."
         }
-        if ($packagedManifest.Version -ne $manifest.Version) {
-            throw "Packaged manifest version '$($packagedManifest.Version)' does not match release manifest version '$($manifest.Version)'."
-        }
+        if ($packagedManifest.Version -ne $manifest.Version) {
+            throw "Packaged manifest version '$($packagedManifest.Version)' does not match release manifest version '$($manifest.Version)'."
+        }
+        $packagedManifestData = Import-PowerShellDataFile -LiteralPath $packagedManifestPath
+        if ($RequireReleaseNotes -and [String]::IsNullOrWhiteSpace($packagedManifestData.PrivateData.PSData.ReleaseNotes)) {
+            throw 'Packaged manifest release notes are empty.'
+        }
+        if ($PSBoundParameters.ContainsKey('ExpectedPrerelease') -and $packagedManifestData.PrivateData.PSData.Prerelease -ne $ExpectedPrerelease) {
+            throw "Packaged manifest prerelease '$($packagedManifestData.PrivateData.PSData.Prerelease)' does not match expected '$ExpectedPrerelease'."
+        }
     }
     catch {
         throw "Release package validation failed for '$PackagePath': $($_.Exception.Message)"
diff --git a/CODEOWNERS b/CODEOWNERS
index a98ac83..ad2d819 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -1,6 +1,8 @@
-.github/workflows               @atlassianps/ci-managers
-JiraPS.build.ps1                @atlassianps/ci-managers
-PPSScriptAnalyzerSettings.psd1  @atlassianps/ci-managers
-Tools/                          @atlassianps/ci-managers
+.github/workflows/                              @atlassianps/ci-managers
+.github/actions/                                @atlassianps/ci-managers
+AtlassianPS.Standards.build.ps1                 @atlassianps/ci-managers
+AtlassianPS.Standards/AtlassianPS.Standards.psd1 @atlassianps/ci-managers
+Tools/                                           @atlassianps/ci-managers
+docs/ReleaseBlueprint.md                         @atlassianps/ci-managers
 
 *                               @atlassianps/maintainers
diff --git a/README.md b/README.md
index a3186f2..61d4d32 100644
--- a/README.md
+++ b/README.md
@@ -61,9 +61,9 @@ Invoke-Build -Task Lint, Build, Test
 ## Release
 
 Label-based CD runs after release-labelled pull requests merge to `master`.
-It computes the next semantic version from the merged PR's `release:*` label, prepares `CHANGELOG.md`, stamps the source manifest, commits that release metadata to `master`, validates the release metadata, creates an annotated tag, publishes to PowerShell Gallery, creates the GitHub release from the same changelog section, and notifies the website to update its module submodule.
-The release-preparation commit also stamps the source module manifest with the exact released version and release notes so the tagged repository state matches the published package metadata.
-The workflow should use `ATLASSIANPS_RELEASE_BOT_TOKEN` when pushing the release metadata commit and tag if branch protection does not allow the default `GITHUB_TOKEN` to push to `master`.
+It computes the next semantic version from the merged PR's `release:*` label, prepares `CHANGELOG.md`, stamps the source manifest version, commits that release metadata to `master`, validates the final package, creates an annotated tag, publishes to PowerShell Gallery, creates the GitHub release from the same changelog section, and notifies the website to update its module submodule.
+The release-preparation commit stamps the exact source version. Release notes are stamped into, then validated in, the final package before publishing.
+The workflow requires `ATLASSIANPS_RELEASE_BOT_TOKEN` to push release metadata and tags. `GITHUB_TOKEN` cannot trigger the follow-up CI required for CD.
 
 The continuous release workflow will:
 
diff --git a/Tests/Functions/Public/BlueprintHelpers.Unit.Tests.ps1 b/Tests/Functions/Public/BlueprintHelpers.Unit.Tests.ps1
index 51c17d0..73a62e1 100644
--- a/Tests/Functions/Public/BlueprintHelpers.Unit.Tests.ps1
+++ b/Tests/Functions/Public/BlueprintHelpers.Unit.Tests.ps1
@@ -62,7 +62,7 @@ Describe 'Import-DotEnvFile' {
 }
 
 Describe 'Test-ModulePackage' {
-    It 'validates a release module directory, manifest, and package' {
+    It 'validates a release module directory, manifest, and package' {
         $buildOutput = Join-Path -Path $TestDrive -ChildPath 'Release'
         $moduleName = 'PackageValidation'
         $modulePath = Join-Path -Path $buildOutput -ChildPath $moduleName
@@ -74,8 +74,74 @@ Describe 'Test-ModulePackage' {
         $result = Test-AtlassianPSModulePackage -BuildOutputPath $buildOutput -ModuleName $moduleName
 
         $result.Name | Should -Be $moduleName
-        $result.Version | Should -Be ([Version]'1.2.3')
-    }
+        $result.Version | Should -Be ([Version]'1.2.3')
+    }
+
+    It 'requires matching version and release notes when requested' {
+        $buildOutput = Join-Path -Path $TestDrive -ChildPath 'Release-metadata'
+        $moduleName = 'PackageMetadata'
+        $modulePath = Join-Path -Path $buildOutput -ChildPath $moduleName
+        $null = New-Item -Path $modulePath -ItemType Directory -Force
+        $manifestPath = Join-Path -Path $modulePath -ChildPath "$moduleName.psd1"
+        Set-Content -LiteralPath $manifestPath -Value @"
+@{
+    RootModule = '$moduleName.psm1'
+    ModuleVersion = '1.2.3'
+    GUID = 'b558bd8c-dc02-4ff2-96b7-4d2c61d9d103'
+    PrivateData = @{
+        PSData = @{
+            ReleaseNotes = 'Release notes'
+        }
+    }
+}
+"@
+        Set-Content -LiteralPath (Join-Path -Path $modulePath -ChildPath "$moduleName.psm1") -Value ''
+        Compress-Archive -Path $modulePath -DestinationPath (Join-Path -Path $buildOutput -ChildPath "$moduleName.zip")
+
+        $result = Test-AtlassianPSModulePackage `
+            -BuildOutputPath $buildOutput `
+            -ModuleName $moduleName `
+            -ExpectedVersion '1.2.3' `
+            -RequireReleaseNotes
+
+        $result.Version | Should -Be ([Version]'1.2.3')
+    }
+
+    It 'rejects a mismatched expected version' {
+        $buildOutput = Join-Path -Path $TestDrive -ChildPath 'Release-version-mismatch'
+        $moduleName = 'VersionMismatch'
+        $modulePath = Join-Path -Path $buildOutput -ChildPath $moduleName
+        $null = New-Item -Path $modulePath -ItemType Directory -Force
+        New-ModuleManifest -Path (Join-Path -Path $modulePath -ChildPath "$moduleName.psd1") -RootModule "$moduleName.psm1" -ModuleVersion '1.2.3'
+        Set-Content -LiteralPath (Join-Path -Path $modulePath -ChildPath "$moduleName.psm1") -Value ''
+        Compress-Archive -Path $modulePath -DestinationPath (Join-Path -Path $buildOutput -ChildPath "$moduleName.zip")
+
+        {
+            Test-AtlassianPSModulePackage -BuildOutputPath $buildOutput -ModuleName $moduleName -ExpectedVersion '1.2.4'
+        } | Should -Throw -ExpectedMessage '*does not match expected*'
+    }
+
+    It 'rejects a mismatched expected prerelease label' {
+        $buildOutput = Join-Path -Path $TestDrive -ChildPath 'Release-prerelease-mismatch'
+        $moduleName = 'PrereleaseMismatch'
+        $modulePath = Join-Path -Path $buildOutput -ChildPath $moduleName
+        $null = New-Item -Path $modulePath -ItemType Directory -Force
+        $manifestPath = Join-Path -Path $modulePath -ChildPath "$moduleName.psd1"
+        Set-Content -LiteralPath $manifestPath -Value @"
+@{
+    RootModule = '$moduleName.psm1'
+    ModuleVersion = '1.2.3'
+    GUID = 'b558bd8c-dc02-4ff2-96b7-4d2c61d9d103'
+    PrivateData = @{ PSData = @{ Prerelease = 'beta' } }
+}
+"@
+        Set-Content -LiteralPath (Join-Path -Path $modulePath -ChildPath "$moduleName.psm1") -Value ''
+        Compress-Archive -Path $modulePath -DestinationPath (Join-Path -Path $buildOutput -ChildPath "$moduleName.zip")
+
+        {
+            Test-AtlassianPSModulePackage -BuildOutputPath $buildOutput -ModuleName $moduleName -ExpectedPrerelease 'rc-2'
+        } | Should -Throw -ExpectedMessage '*prerelease*does not match expected*'
+    }
 
     It 'throws when the release package is missing' {
         $buildOutput = Join-Path -Path $TestDrive -ChildPath 'Release-missing-package'
diff --git a/Tests/Functions/Public/BuildOrchestration.Unit.Tests.ps1 b/Tests/Functions/Public/BuildOrchestration.Unit.Tests.ps1
index 2405268..5246399 100644
--- a/Tests/Functions/Public/BuildOrchestration.Unit.Tests.ps1
+++ b/Tests/Functions/Public/BuildOrchestration.Unit.Tests.ps1
@@ -5,8 +5,22 @@ BeforeAll {
     $script:moduleToTest = Initialize-TestEnvironment
 }
 
-Describe 'Invoke-ModuleTests' {
-    It 'merges tag filters and clears excluded paths for Integration runs' {
+Describe 'Invoke-ModuleTests' {
+    It 'imports selected Pester version globally for test scripts' {
+        InModuleScope AtlassianPS.Standards {
+            Mock -CommandName Get-UsablePesterVersion -MockWith { [Version]'5.9.0' }
+            Mock -CommandName Get-Module -MockWith { $null } -ParameterFilter { $Name -eq 'Pester' }
+            Mock -CommandName Import-Module -MockWith {}
+
+            $null = Import-PesterVersion -MinimumVersion ([Version]'5.7.0') -MaximumVersion ([Version]'5.999.0')
+
+            Should -Invoke -CommandName Import-Module -Times 1 -Exactly -ParameterFilter {
+                $Name -eq 'Pester' -and $RequiredVersion -eq [Version]'5.9.0' -and $Global -and $ErrorAction -eq 'Stop'
+            }
+        }
+    }
+
+    It 'merges tag filters and clears excluded paths for Integration runs' {
         $testsPath = Join-Path -Path $TestDrive -ChildPath 'tests'
         $null = New-Item -Path $testsPath -ItemType Directory -Force
 
diff --git a/Tests/GitHubActions.Tests.ps1 b/Tests/GitHubActions.Tests.ps1
index b53b304..6aba8fc 100644
--- a/Tests/GitHubActions.Tests.ps1
+++ b/Tests/GitHubActions.Tests.ps1
@@ -14,7 +14,7 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
             $route = @($arguments | Where-Object { $_ -like 'repos/*' } | Select-Object -First 1)
 
             if ($route -like 'repos/*/commits/*/pulls') {
-                '{"number":42,"title":"Fix release notes","user":"tester"}'
+                '{"number":42,"title":"Fix release notes","user":{"login":"tester"},"merged_at":"2026-01-01T00:00:00Z","merge_commit_sha":"abc123"}'
                 return
             }
 
@@ -29,7 +29,17 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
 
         function git {
             $arguments = [String[]]$args
-            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--list') {
+            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--merged') {
+                'v1.2.3'
+                return
+            }
+
+            if ($arguments[0] -eq 'rev-list') {
+                'abc123'
+                return
+            }
+
+            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--list') {
                 'v1.2.3'
                 'v1.3.0-beta'
                 return
@@ -45,11 +55,15 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
 
         $outputPath = Join-Path -Path $TestDrive -ChildPath 'manual-github-output.txt'
         $previousRepository = $env:GITHUB_REPOSITORY
-        $previousCommitSha = $env:COMMIT_SHA
-        $previousChangelogDirectory = $env:CHANGELOG_DIRECTORY
-        $previousOutput = $env:GITHUB_OUTPUT
-        try {
-            $env:GITHUB_REPOSITORY = 'AtlassianPS/AtlassianPS.Standards'
+        $previousCommitSha = $env:COMMIT_SHA
+        $previousChangelogDirectory = $env:CHANGELOG_DIRECTORY
+        $previousOutput = $env:GITHUB_OUTPUT
+        $pushedLocation = $false
+        try {
+            Push-Location -Path $TestDrive
+            $pushedLocation = $true
+            Remove-Item -LiteralPath (Join-Path -Path $TestDrive -ChildPath '.changelog') -Recurse -Force -ErrorAction SilentlyContinue
+            $env:GITHUB_REPOSITORY = 'AtlassianPS/AtlassianPS.Standards'
             $env:COMMIT_SHA = 'abc123'
             $env:CHANGELOG_DIRECTORY = '.changelog'
             $env:GITHUB_OUTPUT = $outputPath
@@ -58,28 +72,30 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
         }
         finally {
             $env:GITHUB_REPOSITORY = $previousRepository
-            $env:COMMIT_SHA = $previousCommitSha
-            $env:CHANGELOG_DIRECTORY = $previousChangelogDirectory
-            $env:GITHUB_OUTPUT = $previousOutput
+            $env:COMMIT_SHA = $previousCommitSha
+            $env:CHANGELOG_DIRECTORY = $previousChangelogDirectory
+            $env:GITHUB_OUTPUT = $previousOutput
+            if ($pushedLocation) {
+                Pop-Location
+            }
         }
 
         $output = Get-Content -LiteralPath $outputPath -Raw
         $output | Should -Match 'should_release=true'
         $output | Should -Match 'release_impact=minor'
-        $output | Should -Match 'changelog_type=fixed'
-        $output | Should -Match 'release_version=1.3.0'
-        $output | Should -Match 'release_tag=v1.3.0'
-        $output | Should -Match 'fragment_path=.changelog/42.minor.fixed.md'
-        $output | Should -Match ([Regex]::Escape('fragment_content=* Fix release notes (#42, @tester)'))
+        $output | Should -Match 'release_version=1.3.0'
+        $output | Should -Match 'release_tag=v1.3.0'
+        $fragmentPath = Join-Path -Path $TestDrive -ChildPath '.changelog/42.minor.fixed.md'
+        (Get-Content -LiteralPath $fragmentPath -Raw) | Should -Match ([Regex]::Escape('* Fix release notes (#42, @tester)'))
     }
 
-    It 'plan-merged-release skips release:none merged PRs' {
+    It 'plan-merged-release skips release:none merged PRs' {
         function gh {
             $arguments = [String[]]$args
             $route = @($arguments | Where-Object { $_ -like 'repos/*' } | Select-Object -First 1)
 
             if ($route -like 'repos/*/commits/*/pulls') {
-                '{"number":43,"title":"Update docs","user":"tester"}'
+                '{"number":43,"title":"Update docs","user":{"login":"tester"},"merged_at":"2026-01-01T00:00:00Z","merge_commit_sha":"def456"}'
                 return
             }
 
@@ -91,13 +107,30 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
             throw "Unexpected gh invocation: $($arguments -join ' ')"
         }
 
-        $outputPath = Join-Path -Path $TestDrive -ChildPath 'github-output.txt'
-        $previousRepository = $env:GITHUB_REPOSITORY
-        $previousCommitSha = $env:COMMIT_SHA
-        $previousChangelogDirectory = $env:CHANGELOG_DIRECTORY
-        $previousOutput = $env:GITHUB_OUTPUT
-        try {
-            $env:GITHUB_REPOSITORY = 'AtlassianPS/AtlassianPS.Standards'
+        function git {
+            $arguments = [String[]]$args
+            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--merged') {
+                'v1.2.3'
+                return
+            }
+            if ($arguments[0] -eq 'rev-list') {
+                'def456'
+                return
+            }
+            throw "Unexpected git invocation: $($arguments -join ' ')"
+        }
+
+        $outputPath = Join-Path -Path $TestDrive -ChildPath 'github-output.txt'
+        $previousRepository = $env:GITHUB_REPOSITORY
+        $previousCommitSha = $env:COMMIT_SHA
+        $previousChangelogDirectory = $env:CHANGELOG_DIRECTORY
+        $previousOutput = $env:GITHUB_OUTPUT
+        $pushedLocation = $false
+        try {
+            Push-Location -Path $TestDrive
+            $pushedLocation = $true
+            Remove-Item -LiteralPath (Join-Path -Path $TestDrive -ChildPath '.changelog') -Recurse -Force -ErrorAction SilentlyContinue
+            $env:GITHUB_REPOSITORY = 'AtlassianPS/AtlassianPS.Standards'
             $env:COMMIT_SHA = 'def456'
             $env:CHANGELOG_DIRECTORY = '.changelog'
             $env:GITHUB_OUTPUT = $outputPath
@@ -106,15 +139,97 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
         }
         finally {
             $env:GITHUB_REPOSITORY = $previousRepository
-            $env:COMMIT_SHA = $previousCommitSha
-            $env:CHANGELOG_DIRECTORY = $previousChangelogDirectory
-            $env:GITHUB_OUTPUT = $previousOutput
+            $env:COMMIT_SHA = $previousCommitSha
+            $env:CHANGELOG_DIRECTORY = $previousChangelogDirectory
+            $env:GITHUB_OUTPUT = $previousOutput
+            if ($pushedLocation) {
+                Pop-Location
+            }
         }
 
         $output = Get-Content -LiteralPath $outputPath -Raw
         $output | Should -Match 'should_release=false'
         $output | Should -Match 'skip_reason=release:none'
-    }
+    }
+
+    It 'plan-merged-release batches merged pull requests and selects highest impact' {
+        function gh {
+            $arguments = [String[]]$args
+            $route = @($arguments | Where-Object { $_ -like 'repos/*' } | Select-Object -First 1)
+
+            if ($route -like 'repos/*/commits/first/pulls') {
+                '{"number":43,"title":"First","user":{"login":"tester"},"merged_at":"2026-01-01T00:00:00Z","merge_commit_sha":"abc123"}'
+                return
+            }
+            if ($route -like 'repos/*/commits/second/pulls') {
+                '{"number":44,"title":"Second","user":{"login":"tester"},"merged_at":"2026-01-01T00:00:00Z","merge_commit_sha":"abc123"}'
+                return
+            }
+
+            if ($route -like 'repos/*/issues/43/labels') {
+                'release:patch'
+                'changelog:fixed'
+                return
+            }
+            if ($route -like 'repos/*/issues/44/labels') {
+                'release:minor'
+                'changelog:added'
+                return
+            }
+
+            throw "Unexpected gh invocation: $($arguments -join ' ')"
+        }
+
+        function git {
+            $arguments = [String[]]$args
+            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--merged') {
+                'v1.2.3'
+                return
+            }
+            if ($arguments[0] -eq 'rev-list') {
+                'first'
+                'second'
+                return
+            }
+            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--list') {
+                'v1.2.3'
+                return
+            }
+            if ($arguments[0] -eq 'show-ref') {
+                Set-Variable -Name LASTEXITCODE -Value 1 -Scope 1
+                return
+            }
+            throw "Unexpected git invocation: $($arguments -join ' ')"
+        }
+
+        $outputPath = Join-Path -Path $TestDrive -ChildPath 'batched-github-output.txt'
+        $previousRepository = $env:GITHUB_REPOSITORY
+        $previousCommitSha = $env:COMMIT_SHA
+        $previousOutput = $env:GITHUB_OUTPUT
+        $pushedLocation = $false
+        try {
+            Push-Location -Path $TestDrive
+            $pushedLocation = $true
+            Remove-Item -LiteralPath (Join-Path -Path $TestDrive -ChildPath '.changelog') -Recurse -Force -ErrorAction SilentlyContinue
+            $env:GITHUB_REPOSITORY = 'AtlassianPS/AtlassianPS.Standards'
+            $env:COMMIT_SHA = 'head123'
+            $env:GITHUB_OUTPUT = $outputPath
+
+            & $script:planMergedReleaseScriptPath
+        }
+        finally {
+            $env:GITHUB_REPOSITORY = $previousRepository
+            $env:COMMIT_SHA = $previousCommitSha
+            $env:GITHUB_OUTPUT = $previousOutput
+            if ($pushedLocation) {
+                Pop-Location
+            }
+        }
+
+        $output = Get-Content -LiteralPath $outputPath -Raw
+        $output | Should -Match 'should_release=true'
+        $output | Should -Match 'release_impact=minor'
+    }
 
     It 'plan-merged-release computes a manual release without generating a PR fragment' {
         function gh {
@@ -163,10 +278,10 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
         $LASTEXITCODE | Should -Be 0
     }
 
-    It 'plan-merged-release computes a manual prerelease tag' {
-        function git {
-            $arguments = [String[]]$args
-            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--list') {
+    It 'plan-merged-release computes a manual prerelease tag' {
+        function git {
+            $arguments = [String[]]$args
+            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--list') {
                 'v2.3.4'
                 return
             }
@@ -216,7 +331,7 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
             $route = @($arguments | Where-Object { $_ -like 'repos/*' } | Select-Object -First 1)
 
             if ($route -like 'repos/*/commits/*/pulls') {
-                '{"number":44,"title":"Change defaults","user":"tester"}'
+                '{"number":44,"title":"Change defaults","user":{"login":"tester"},"merged_at":"2026-01-01T00:00:00Z","merge_commit_sha":"ghi789"}'
                 return
             }
 
@@ -229,9 +344,17 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
             throw "Unexpected gh invocation: $($arguments -join ' ')"
         }
 
-        function git {
-            $arguments = [String[]]$args
-            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--list') {
+        function git {
+            $arguments = [String[]]$args
+            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--merged') {
+                'v1.2.3'
+                return
+            }
+            if ($arguments[0] -eq 'rev-list') {
+                'ghi789'
+                return
+            }
+            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--list') {
                 'v1.2.3'
                 return
             }
@@ -242,10 +365,14 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
         $outputPath = Join-Path -Path $TestDrive -ChildPath 'github-output.txt'
         $previousRepository = $env:GITHUB_REPOSITORY
         $previousCommitSha = $env:COMMIT_SHA
-        $previousChangelogDirectory = $env:CHANGELOG_DIRECTORY
-        $previousOutput = $env:GITHUB_OUTPUT
-        try {
-            $env:GITHUB_REPOSITORY = 'AtlassianPS/AtlassianPS.Standards'
+        $previousChangelogDirectory = $env:CHANGELOG_DIRECTORY
+        $previousOutput = $env:GITHUB_OUTPUT
+        $pushedLocation = $false
+        try {
+            Push-Location -Path $TestDrive
+            $pushedLocation = $true
+            Remove-Item -LiteralPath (Join-Path -Path $TestDrive -ChildPath '.changelog') -Recurse -Force -ErrorAction SilentlyContinue
+            $env:GITHUB_REPOSITORY = 'AtlassianPS/AtlassianPS.Standards'
             $env:COMMIT_SHA = 'ghi789'
             $env:CHANGELOG_DIRECTORY = '.changelog'
             $env:GITHUB_OUTPUT = $outputPath
@@ -254,9 +381,12 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
         }
         finally {
             $env:GITHUB_REPOSITORY = $previousRepository
-            $env:COMMIT_SHA = $previousCommitSha
-            $env:CHANGELOG_DIRECTORY = $previousChangelogDirectory
-            $env:GITHUB_OUTPUT = $previousOutput
+            $env:COMMIT_SHA = $previousCommitSha
+            $env:CHANGELOG_DIRECTORY = $previousChangelogDirectory
+            $env:GITHUB_OUTPUT = $previousOutput
+            if ($pushedLocation) {
+                Pop-Location
+            }
         }
     }
 
@@ -271,19 +401,35 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
         # Module-domain work lives in Invoke-Build tasks; deployment plumbing lives in composite
         # actions. Neither manifest stamping nor packaging appears inline in the workflow.
         $workflow | Should -Match 'Invoke-Build -Task SetSourceVersion'
-        $workflow | Should -Match 'Invoke-Build -Task SetVersion .*-VerifyPublishedRelease'
-        $workflow | Should -Match 'Invoke-Build -Task Package'
+        $workflow | Should -Match 'Invoke-Build -Task SetVersion .*-VerifyPublishedRelease'
+        $workflow | Should -Match 'Invoke-Build -Task Package'
+        $workflow | Should -Match 'Invoke-Build -Task VerifyReleaseArtifact'
         $workflow | Should -Match 'uses: \./\.github/actions/commit-release-metadata'
-        $workflow | Should -Match 'uses: \./\.github/actions/create-release-tag'
+        $workflow | Should -Match 'uses: \./\.github/actions/create-release-tag'
+        $workflow | Should -Match 'uses: \./\.github/actions/resolve-release-tag'
         $workflow | Should -Not -Match 'Set-AtlassianPSModuleManifestVersion'
         $workflow | Should -Not -Match 'Get-AtlassianPSReleaseNotesFromChangelog'
         $workflow | Should -Not -Match 'Compress-Archive'
 
-        # The artifact is stamped and verified before it is published to immutable PSGallery.
-        $verifyIndex = $workflow.IndexOf('-VerifyPublishedRelease')
-        $publishIndex = $workflow.IndexOf('Publish-Module')
-        $verifyIndex | Should -BeGreaterThan -1
-        $publishIndex | Should -BeGreaterThan $verifyIndex
+        # Final package validation and tag creation precede immutable PSGallery publish.
+        $verifyIndex = $workflow.IndexOf('Invoke-Build -Task VerifyReleaseArtifact')
+        $tagIndex = $workflow.IndexOf('uses: ./.github/actions/create-release-tag')
+        $resolveTagIndex = $workflow.IndexOf('uses: ./.github/actions/resolve-release-tag')
+        $publishIndex = $workflow.IndexOf('Publish-Module')
+        $verifyIndex | Should -BeGreaterThan -1
+        $publishIndex | Should -BeGreaterThan $verifyIndex
+        $tagIndex | Should -BeGreaterThan $verifyIndex
+        $resolveTagIndex | Should -BeGreaterThan $tagIndex
+        $publishIndex | Should -BeGreaterThan $tagIndex
+
+        # Recovery reuses only a tagged master commit with successful CI artifact provenance.
+        $workflow | Should -Match 'recovery_tag:'
+        $workflow | Should -Match 'No successful CI run was found for recovery commit'
+        $workflow | Should -Match 'skipping immutable publish'
+        $workflow | Should -Match 'RECOVERY_TAG'
+        $workflow | Should -Match "workflow_run\.event == 'push'"
+        $workflow | Should -Match 'PREPARED_COMMIT_MESSAGE'
+        $workflow | Should -Match 'ATLASSIANPS_RELEASE_BOT_TOKEN'
     }
 
     It 'keeps publishing secrets and publish tasks out of the build script' {
@@ -340,10 +486,23 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
                 return
             }
 
-            throw "Unexpected gh invocation: $($arguments -join ' ')"
-        }
-
-        $outputPath = Join-Path -Path $TestDrive -ChildPath 'github-output.txt'
+            throw "Unexpected gh invocation: $($arguments -join ' ')"
+        }
+
+        function git {
+            $arguments = [String[]]$args
+            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--merged') {
+                'v1.2.3'
+                return
+            }
+            if ($arguments[0] -eq 'rev-list') {
+                'def456'
+                return
+            }
+            throw "Unexpected git invocation: $($arguments -join ' ')"
+        }
+
+        $outputPath = Join-Path -Path $TestDrive -ChildPath 'github-output.txt'
         $previousPrNumber = $env:PR_NUMBER
         $previousRepository = $env:GITHUB_REPOSITORY
         $previousChangelogDirectory = $env:CHANGELOG_DIRECTORY
@@ -422,10 +581,23 @@ Describe 'GitHub Actions' -Tag 'Lint', 'Unit' {
                 return
             }
 
-            throw "Unexpected gh invocation: $($arguments -join ' ')"
-        }
-
-        $outputPath = Join-Path -Path $TestDrive -ChildPath 'github-output.txt'
+            throw "Unexpected gh invocation: $($arguments -join ' ')"
+        }
+
+        function git {
+            $arguments = [String[]]$args
+            if ($arguments[0] -eq 'tag' -and $arguments[1] -eq '--merged') {
+                'v1.2.3'
+                return
+            }
+            if ($arguments[0] -eq 'rev-list') {
+                'def456'
+                return
+            }
+            throw "Unexpected git invocation: $($arguments -join ' ')"
+        }
+
+        $outputPath = Join-Path -Path $TestDrive -ChildPath 'github-output.txt'
         $previousPrNumber = $env:PR_NUMBER
         $previousRepository = $env:GITHUB_REPOSITORY
         $previousChangelogDirectory = $env:CHANGELOG_DIRECTORY
diff --git a/Tools/build.requirements.psd1 b/Tools/build.requirements.psd1
index 95a4d46..55c4d3a 100644
--- a/Tools/build.requirements.psd1
+++ b/Tools/build.requirements.psd1
@@ -1,4 +1,4 @@
 @(
     @{ ModuleName = "InvokeBuild"; RequiredVersion = "5.14.23" }
-    @{ ModuleName = "Pester"; RequiredVersion = "5.7.1" }
+    @{ ModuleName = "Pester"; RequiredVersion = "5.9.0" }
 )
diff --git a/docs/BlueprintHelpers.md b/docs/BlueprintHelpers.md
index 86c35e5..d6ece57 100644
--- a/docs/BlueprintHelpers.md
+++ b/docs/BlueprintHelpers.md
@@ -104,8 +104,8 @@ Task SetVersion {
 Release automation should fold pending changelog entries and custom fragments into the next version section, then delete the consumed fragments.
 Use the `prepare-release-changelog` composite action instead of exporting another module helper for GitHub-only release mechanics.
 In the continuous release workflow, commit the resulting `CHANGELOG.md` update and `.changelog` deletions directly to `master` after a release-labelled PR merges.
-Commit the source module manifest version and release notes in that same release metadata commit so repository readers do not see drift between the tag, changelog, and manifest metadata.
-For manual release preparation, commit the same files before tagging the release.
+Commit the source module manifest version in the release metadata commit. Stamp release notes only into final release artifact, then validate package before publishing; source manifest keeps release notes empty.
+For manual release preparation, commit source version and changelog before tagging the release.
 
 ```yaml
 - uses: AtlassianPS/AtlassianPS.Standards/.github/actions/prepare-release-changelog@<standards-sha>
diff --git a/docs/ReleaseBlueprint.md b/docs/ReleaseBlueprint.md
index fbdd48f..07aeab9 100644
--- a/docs/ReleaseBlueprint.md
+++ b/docs/ReleaseBlueprint.md
@@ -42,17 +42,19 @@ After CI succeeds on a normal merged pull request with `release:patch`, `release
 8. Commit the release metadata changes directly to `master`.
 9. Let CI build and test the bot-authored release metadata commit (the built artifact inherits the stamped version).
 10. Download the CI `Release` artifact from that exact commit.
-11. Create an annotated tag on the tested release metadata commit.
-12. Build release notes from the committed `CHANGELOG.md` section.
-13. Run `Invoke-Build -Task SetVersion ... -VerifyPublishedRelease` to populate release notes into the tested artifact and verify its version, without rebuilding the package.
-14. Publish the verified module artifact to PSGallery.
-15. Create the GitHub release with the same release notes body.
-16. Notify the website to update its module submodule.
+11. Build release notes from the committed `CHANGELOG.md` section.
+12. Run `Invoke-Build -Task SetVersion ... -VerifyPublishedRelease` to populate release notes into the tested artifact and verify its version, without rebuilding the package.
+13. Package and validate the final artifact, including manifest version, release notes, and archive contents.
+14. Create an annotated tag on the tested release metadata commit.
+15. Publish the verified module artifact to PSGallery.
+16. Create the GitHub release with the same release notes body.
+17. Notify the website to update its module submodule.
 
 `release:none` merges should stop after planning and must not publish.
 The workflow should be serialized with concurrency so multiple release-labelled merges do not race the next-version calculation.
-Use `GITHUB_TOKEN` by default when committing release metadata to `master`.
-Keep an optional release automation token, for example `ATLASSIANPS_RELEASE_BOT_TOKEN`, only for repositories where branch protection or repository rules block `GITHUB_TOKEN` pushes.
+Use a GitHub App or fine-grained automation token, for example `ATLASSIANPS_RELEASE_BOT_TOKEN`, when committing release metadata and creating annotated tags. `GITHUB_TOKEN` pushes do not trigger the required follow-up CI workflow, so they cannot drive this CD flow.
+
+`master` must reject direct pushes before enabling release publishing. The publish workflow identifies release metadata by trusted workflow provenance and commit format; without branch protection, a direct writer can imitate that format. Protect `v*` tags from mutation and deletion.
 
 When unreleased changes already exist on `master` without an associated merged release-labelled PR, use the manual `workflow_dispatch` input on `continuous_release.yml` and choose the release impact for the whole bucket.
 Manual dispatch must still check out `master`, not the arbitrary ref selected in the GitHub UI.
@@ -64,7 +66,22 @@ The generated tag and changelog section use forms like `vX.Y.Z-alpha`, `vX.Y.Z-b
 
 Do not keep a separate tag-triggered release workflow unless it is intentionally idempotent across already-created tags, PSGallery packages, GitHub releases, uploaded assets, and website notifications.
 The default AtlassianPS release path has one publishing workflow: `continuous_release.yml`.
-If a release fails after publishing an immutable PSGallery package, repair the failed downstream artifact directly, for example by creating the missing GitHub release or rerunning the website dispatch, instead of rerunning a workflow that calls `Publish-Module` again.
+If a release fails after the metadata commit, rerun `continuous_release.yml` with `recovery_tag` set to the existing release tag. Recovery requires that tag to identify a commit reachable from `master`, locates successful CI for that commit, rebuilds and validates its package, and skips PSGallery only when exact module version already exists. It then reconciles GitHub release asset and website notification.
+Do not use recovery for a tag that lacks successful CI or points outside `master`; investigate and repair source state first.
+
+### Recovery Runbook
+
+Use recovery only for a partial release: an existing release-preparation commit and tag, but one or more publish stages did not finish. It is not a replacement for the normal manual release path.
+
+1. Inspect the release tag, its commit, the matching `master` CI run, PSGallery, GitHub release, release asset, and website dispatch state.
+2. Confirm the tag is annotated and its commit is reachable from `origin/master`.
+3. Confirm successful CI produced the `Release` artifact for that exact commit.
+4. Confirm `CHANGELOG.md` has a non-empty section matching the tag and source manifest has matching numeric version.
+5. Dispatch `Continuous Release` from `master` with only `recovery_tag` set to that tag, for example `v1.2.3`. Leave `release_impact` and `prerelease` empty.
+6. Monitor the run. It rebuilds release notes, validates package version/notes/archive, verifies or creates the tag, publishes only when PSGallery lacks that exact version, then creates or updates GitHub release asset and sends stable-release website notification.
+7. Verify PSGallery version, annotated tag target, GitHub release body and asset, and website update. Record any intentionally skipped downstream stage.
+
+Never delete, retag, or republish an existing PSGallery version to recover a release. If provenance checks fail, stop and repair the release metadata through a normal reviewed change.
 
 ## Required Shared Actions
 
@@ -322,14 +339,13 @@ PSGALLERY_API_KEY
 HOMEPAGE_PAT
 ```
 
-Optional secret:
+Required secret:
 
 ```text
 ATLASSIANPS_RELEASE_BOT_TOKEN
 ```
 
-Use `ATLASSIANPS_RELEASE_BOT_TOKEN` when branch protection or repository rules prevent `GITHUB_TOKEN` from pushing the release metadata commit and annotated tag to `master`.
-If the repository has no branch protection, `GITHUB_TOKEN` is enough.
+`ATLASSIANPS_RELEASE_BOT_TOKEN` must be a GitHub App or fine-grained token able to push release metadata and tags. `GITHUB_TOKEN` is insufficient because its pushes do not trigger follow-up CI.
 
 ### Release Intent Workflow
 
@@ -361,7 +377,9 @@ Make `Release Intent` a required branch-protection check when the repository use
 
 ### Continuous Release Workflow
 
-Add `.github/workflows/continuous_release.yml`:
+Add `.github/workflows/continuous_release.yml`:
+
+The full workflow contains security-sensitive recovery and publish logic. Start from the current Standards workflow and replace local action paths with pins for one Standards release; do not copy an older workflow from another module.
 
 ```yaml
 name: Continuous Release
@@ -372,18 +390,22 @@ on:
     types: [completed]
   workflow_dispatch:
     inputs:
-      release_impact:
+      release_impact:
         description: Release impact for unreleased changes already on master
-        required: true
+        required: false
         type: choice
         options:
           - patch
           - minor
           - major
-      prerelease:
+      prerelease:
         description: Optional prerelease label for unreleased changes already on master, for example alpha, beta, rc, or rc-2
-        required: false
-        type: string
+        required: false
+        type: string
+      recovery_tag:
+        description: Existing release tag to recover after a partial publish, for example v1.2.3
+        required: false
+        type: string
 
 concurrency:
   group: continuous-release
@@ -398,8 +420,9 @@ jobs:
   prepare:
     name: Prepare release metadata
     if: >-
-      github.event_name == 'workflow_dispatch' ||
-      (github.event.workflow_run.conclusion == 'success' &&
+      (github.event_name == 'workflow_dispatch' && inputs.recovery_tag == '') ||
+      (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'master' &&
       !startsWith(github.event.workflow_run.head_commit.message, 'Prepare v'))
     runs-on: ubuntu-latest
@@ -447,29 +470,32 @@ jobs:
         with:
           release-tag: ${{ steps.plan.outputs.release_tag }}
           manifest-path: <ModuleName>/<ModuleName>.psd1
-          github-token: ${{ github.token }}
-          release-bot-token: ${{ secrets.ATLASSIANPS_RELEASE_BOT_TOKEN }}
+          release-bot-token: ${{ secrets.ATLASSIANPS_RELEASE_BOT_TOKEN }}
 
   publish:
     name: Publish tested release artifact
     if: >-
-      github.event_name == 'workflow_run' &&
-      github.event.workflow_run.conclusion == 'success' &&
+      (github.event_name == 'workflow_run' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'master' &&
       startsWith(github.event.workflow_run.head_commit.message, 'Prepare v') &&
-      github.event.workflow_run.head_commit.author.name == 'github-actions[bot]'
+      github.event.workflow_run.head_commit.author.name == 'github-actions[bot]') ||
+      (github.event_name == 'workflow_dispatch' && inputs.recovery_tag != '')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          ref: ${{ github.event.workflow_run.head_sha }}
-
-      - name: Resolve prepared release
-        id: prepared_release
-        shell: pwsh
-        run: |
-          $message = '${{ github.event.workflow_run.head_commit.message }}'
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || inputs.recovery_tag }}
+
+      - name: Resolve prepared release
+        id: prepared_release
+        shell: pwsh
+        env:
+          PREPARED_COMMIT_MESSAGE: ${{ github.event.workflow_run.head_commit.message }}
+        run: |
+          $message = $env:PREPARED_COMMIT_MESSAGE
           if ($message -notmatch '^Prepare (?<tag>v\d+\.\d+\.\d+(?:-(?:alpha|beta|rc)(?:-\d+)?)?) release$') {
               throw "Commit message '$message' is not a release metadata commit."
           }
@@ -486,34 +512,49 @@ jobs:
 
       - uses: AtlassianPS/AtlassianPS.Standards/.github/actions/setup-powershell@<standards-sha> # vX.Y.Z
 
-      - name: Create annotated release tag
-        uses: AtlassianPS/AtlassianPS.Standards/.github/actions/create-release-tag@<standards-sha> # vX.Y.Z
-        with:
-          tag: ${{ steps.prepared_release.outputs.release_tag }}
-
-      - name: Resolve release ref
-        id: release_ref
-        uses: AtlassianPS/AtlassianPS.Standards/.github/actions/resolve-release-tag@<standards-sha> # vX.Y.Z
-        with:
-          tag: ${{ steps.prepared_release.outputs.release_tag }}
-
-      - name: Build release notes
+      - name: Build release notes
         id: release_notes
         uses: AtlassianPS/AtlassianPS.Standards/.github/actions/build-release-notes@<standards-sha> # vX.Y.Z
         with:
-          release-version: ${{ steps.release_ref.outputs.release_tag }}
+          release-version: ${{ steps.prepared_release.outputs.release_tag }}
 
       - name: Stamp and verify release artifact
-        run: Invoke-Build -Task SetVersion -VersionToPublish ${{ steps.release_ref.outputs.release_tag }} -VerifyPublishedRelease
+        run: Invoke-Build -Task SetVersion -VersionToPublish ${{ steps.prepared_release.outputs.release_tag }} -VerifyPublishedRelease
         shell: pwsh
 
-      - name: Package release artifact
+      - name: Package release artifact
         run: Invoke-Build -Task Package
-        shell: pwsh
-
-      - name: Publish tested module artifact
-        run: Publish-Module -Path ./Release/<ModuleName> -NuGetApiKey ${{ secrets.PSGALLERY_API_KEY }} -ErrorAction Stop
-        shell: pwsh
+        shell: pwsh
+
+      - name: Verify release artifact
+        run: Invoke-Build -Task VerifyReleaseArtifact -VersionToPublish ${{ steps.prepared_release.outputs.release_tag }}
+        shell: pwsh
+
+      - name: Create annotated release tag
+        uses: AtlassianPS/AtlassianPS.Standards/.github/actions/create-release-tag@<standards-sha> # vX.Y.Z
+        with:
+          tag: ${{ steps.prepared_release.outputs.release_tag }}
+          commit: ${{ steps.prepared_release.outputs.release_commit }}
+          github-token: ${{ secrets.ATLASSIANPS_RELEASE_BOT_TOKEN }}
+
+      - name: Resolve release ref
+        id: release_ref
+        uses: AtlassianPS/AtlassianPS.Standards/.github/actions/resolve-release-tag@<standards-sha> # vX.Y.Z
+        with:
+          tag: ${{ steps.prepared_release.outputs.release_tag }}
+
+      - name: Publish tested module artifact
+        run: |
+          $manifest = Test-ModuleManifest -Path ./Release/<ModuleName>/<ModuleName>.psd1 -ErrorAction Stop
+          $prerelease = [String]$manifest.PrivateData.PSData.Prerelease
+          $expectedGalleryVersion = if ($prerelease) { "$($manifest.Version)-$prerelease" } else { [String]$manifest.Version }
+          $published = Find-Module -Name $manifest.Name -AllVersions -AllowPrerelease -ErrorAction Stop |
+              Where-Object { $_.Version.ToString() -eq $expectedGalleryVersion } |
+              Select-Object -First 1
+          if (-not $published) {
+            Publish-Module -Path ./Release/<ModuleName> -NuGetApiKey ${{ secrets.PSGALLERY_API_KEY }} -ErrorAction Stop
+          }
+        shell: pwsh
 
       - name: Create GitHub release and upload asset
         uses: softprops/action-gh-release@v3