diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7e4c7958..60c82875 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,10 +28,27 @@ jobs:
         with:
           ref: main
 
+      # CANARY-BRIDGE: pin the host Deno used by `deno compile` to the same
+      # canary SHA that scripts/download_deno.ts embeds as a resource. Without
+      # this, `deno compile` runs under the latest stable v2.x and bakes
+      # `denort-<stable>` into the swamp CLI binary — which is the runtime
+      # that executes workflows (and panics on the tls_wrap.rs unwrap until
+      # v2.8.0 ships). See scripts/deno_canary.txt for the back-out checklist.
+      - name: Resolve Deno canary SHA
+        id: canary
+        run: |
+          sha=$(grep -v '^[[:space:]]*#' scripts/deno_canary.txt | grep -v '^[[:space:]]*$' | head -n1 | tr -d '[:space:]')
+          if [ -z "$sha" ]; then
+            echo "scripts/deno_canary.txt has no SHA" >&2
+            exit 1
+          fi
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+          echo "Pinned Deno canary: $sha"
+
       - name: Setup Deno
         uses: denoland/setup-deno@v2
         with:
-          deno-version: v2.x
+          deno-version: canary-${{ steps.canary.outputs.sha }}
 
       - name: Generate version
         id: version
diff --git a/scripts/deno_canary.txt b/scripts/deno_canary.txt
index 20711e37..ffc37929 100644
--- a/scripts/deno_canary.txt
+++ b/scripts/deno_canary.txt
@@ -18,10 +18,13 @@
 #   1. Delete this file (scripts/deno_canary.txt).
 #   2. In scripts/download_deno.ts, delete the two `CANARY-BRIDGE`
 #      blocks (the helpers near the top and the branch in main()).
-#   3. Delete scripts/download_deno_test.ts (or its canary cases).
-#   4. `grep -rn CANARY-BRIDGE` should return zero matches.
-#   5. Bump the system Deno used by CI / contributors to v2.8.0.
-#   6. Rebuild and republish swamp via the normal release flow.
+#   3. In .github/workflows/release.yml, delete the "Resolve Deno canary
+#      SHA" step (marked CANARY-BRIDGE) and change the Setup Deno step's
+#      `deno-version` back to `v2.x` (or the desired stable line).
+#   4. Delete scripts/download_deno_test.ts (or its canary cases).
+#   5. `grep -rn CANARY-BRIDGE` should return zero matches.
+#   6. Bump the system Deno used by CI / contributors to v2.8.0.
+#   7. Rebuild and republish swamp via the normal release flow.
 #
 # Pinned commit (verified to include the tls_wrap fix df8d21c2):
 19bd3d8b99d92f15d20692aca02ac059bbc9ada7