diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index 2ae96b430..be74ab17f 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -170,13 +170,13 @@ jobs:
         include:
           - name: macOS
             os: macos-latest
-            command: bun run dist:mac
+            command: bun run dist:mac:no-publish
           - name: Windows
             os: windows-latest
-            command: bun run dist:win
+            command: bun run dist:win:no-publish
           - name: Linux
             os: ubuntu-22.04
-            command: bun run dist:linux
+            command: bun run dist:linux:no-publish
 
     steps:
       - name: Check out source
@@ -319,6 +319,9 @@ jobs:
           append_env "SENTRY_ELECTRON_INGEST_URL" "$SENTRY_ELECTRON_INGEST_URL_SECRET"
 
       - name: Build desktop installer
+        # Build jobs only produce artifacts. The publish job below owns GitHub
+        # Release creation/upload so dry-run, draft, prerelease, and replace
+        # behavior stays centralized.
         run: ${{ matrix.command }}
 
       - name: Upload installer artifacts
diff --git a/package.json b/package.json
index d9c5f8cfa..4d2396e8e 100644
--- a/package.json
+++ b/package.json
@@ -37,6 +37,9 @@
     "dist:mac": "bun run electron:dist:mac",
     "dist:win": "bun run electron:dist:win",
     "dist:linux": "bun run electron:dist:linux",
+    "dist:mac:no-publish": "bun run electron:dist:mac:no-publish",
+    "dist:win:no-publish": "bun run electron:dist:win:no-publish",
+    "dist:linux:no-publish": "bun run electron:dist:linux:no-publish",
     "test": "bun test && for f in $(find . -name '*.isolated.ts' -not -path './node_modules/*'); do bun test \"$f\" || exit 1; done",
     "typecheck": "bun run typecheck:shared",
     "typecheck:shared": "cd packages/shared && bun run tsc --noEmit",
@@ -89,6 +92,9 @@
     "electron:dist:mac": "bun run electron:vendor:qwen && bun run electron:build && bun run electron:builder-config && cd apps/electron && electron-builder --config electron-builder.generated.yml --mac",
     "electron:dist:win": "bun run electron:vendor:qwen && bun run electron:build && bun run electron:builder-config && cd apps/electron && electron-builder --config electron-builder.generated.yml --win",
     "electron:dist:linux": "bun run electron:vendor:qwen && bun run electron:build && bun run electron:builder-config && cd apps/electron && electron-builder --config electron-builder.generated.yml --linux",
+    "electron:dist:mac:no-publish": "bun run electron:vendor:qwen && bun run electron:build && bun run electron:builder-config && cd apps/electron && electron-builder --config electron-builder.generated.yml --mac --publish never",
+    "electron:dist:win:no-publish": "bun run electron:vendor:qwen && bun run electron:build && bun run electron:builder-config && cd apps/electron && electron-builder --config electron-builder.generated.yml --win --publish never",
+    "electron:dist:linux:no-publish": "bun run electron:vendor:qwen && bun run electron:build && bun run electron:builder-config && cd apps/electron && electron-builder --config electron-builder.generated.yml --linux --publish never",
     "electron:dist:dev:mac": "bun run electron:vendor:qwen && CSC_IDENTITY_AUTO_DISCOVERY=false CRAFT_DEV_RUNTIME=1 bun run electron:build && bun run electron:builder-config && cd apps/electron && CSC_IDENTITY_AUTO_DISCOVERY=false electron-builder --config electron-builder.generated.yml --mac",
     "electron:dist:dev:win": "bun run electron:vendor:qwen && CRAFT_DEV_RUNTIME=1 bun run electron:build && bun run electron:builder-config && cd apps/electron && electron-builder --config electron-builder.generated.yml --win",
     "electron:dist:dev:linux": "bun run electron:vendor:qwen && CRAFT_DEV_RUNTIME=1 bun run electron:build && bun run electron:builder-config && cd apps/electron && electron-builder --config electron-builder.generated.yml --linux",