diff --git a/.github/actions/build-binary-package/action.yml b/.github/actions/build-binary-package/action.yml
index 9893bef..a420a5c 100644
--- a/.github/actions/build-binary-package/action.yml
+++ b/.github/actions/build-binary-package/action.yml
@@ -9,17 +9,10 @@ inputs:
   arch:
     description: "Architecture to build for"
     required: true
-  checkout_ref:
-    description: "Ref to checkout"
-    required: false
-    default: ''
 
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v4
-      with:
-        ref: ${{ inputs.checkout_ref || '' }}
     - name: Determine build architecture
       shell: bash
       run: |
diff --git a/.github/actions/build-source-package/action.yml b/.github/actions/build-source-package/action.yml
index ef89f55..e0583c8 100644
--- a/.github/actions/build-source-package/action.yml
+++ b/.github/actions/build-source-package/action.yml
@@ -7,17 +7,10 @@ inputs:
   release_tag:
     description: "Release tag to build for (value 'unstable' is supported)"
     required: false
-  checkout_ref:
-    description: "Ref to checkout"
-    required: false
-    default: ''
 
 runs:
   using: "composite"
   steps:
-  - uses: actions/checkout@v4
-    with:
-      ref: ${{ inputs.checkout_ref || '' }}
   - name: Install dependencies
     shell: bash
     run: |
diff --git a/.github/actions/run-smoke-tests/action.yml b/.github/actions/run-smoke-tests/action.yml
index 0277704..e262b1f 100644
--- a/.github/actions/run-smoke-tests/action.yml
+++ b/.github/actions/run-smoke-tests/action.yml
@@ -9,17 +9,10 @@ inputs:
   arch:
     description: "Architecture to run smoke tests for"
     required: true
-  checkout_ref:
-    description: "Ref to checkout"
-    required: false
-    default: ''
 
 runs:
   using: "composite"
   steps:
-  - uses: actions/checkout@v4
-    with:
-      ref: ${{ inputs.checkout_ref || '' }}
   - name: Extract distribution from image
     id: extract_dist
     shell: bash
diff --git a/.github/workflows/build-n-test-all-distros.yml b/.github/workflows/build-n-test-all-distros.yml
index e8db6ec..0a4ec63 100644
--- a/.github/workflows/build-n-test-all-distros.yml
+++ b/.github/workflows/build-n-test-all-distros.yml
@@ -49,7 +49,6 @@ jobs:
       with:
         dist: ${{ matrix.dist }}
         release_tag: ${{ inputs.release_tag }}
-        checkout_ref: ${{ inputs.release_tag == 'unstable' && 'unstable' || '' }}
 
   build-binary-package:
     runs-on: ${{ contains(matrix.arch, 'arm') && 'ubuntu24-arm64-2-8' || 'ubuntu-24.04' }}
@@ -78,7 +77,6 @@ jobs:
         dist: ${{ matrix.dist }}
         arch: ${{ matrix.arch }}
         run_id: ${{ github.run_id }}
-        checkout_ref: ${{ inputs.release_tag == 'unstable' && 'unstable' || '' }}
 
   smoke-test-archs:
     runs-on: ubuntu-latest
@@ -115,4 +113,3 @@ jobs:
         image: ${{ matrix.image }}
         arch: ${{ matrix.arch }}
         run_id: ${{ github.run_id }}
-        checkout_ref: ${{ inputs.release_tag == 'unstable' && 'unstable' || '' }}
diff --git a/.github/workflows/release_publish.yml b/.github/workflows/release_publish.yml
index 1bd7d7b..05478b4 100644
--- a/.github/workflows/release_publish.yml
+++ b/.github/workflows/release_publish.yml
@@ -64,7 +64,7 @@ jobs:
         with:
           release_handle: ${{ github.event.inputs.release_handle }}
 
-      - name: Upload staging packages
+      - name: Upload packages
         id: upload
         uses: ./.github/actions/upload-packages
         with:
@@ -72,9 +72,11 @@ jobs:
           release_type: ${{ github.event.inputs.release_type }}
           gh_token: ${{ secrets.GITHUB_TOKEN }}
           APT_SIGNING_KEY: ${{ secrets.APT_SIGNING_KEY }}
-          APT_S3_BUCKET: ${{ secrets.APT_S3_BUCKET_STAGING }}
           APT_S3_REGION: ${{ secrets.APT_S3_REGION }}
-          APT_S3_IAM_ARN: ${{ secrets.APT_S3_IAM_ARN_STAGING }}
+          APT_S3_BUCKET: ${{ github.event.inputs.release_type == 'public' && secrets.APT_S3_BUCKET || secrets.APT_S3_BUCKET_STAGING }}
+          APT_S3_IAM_ARN: ${{ github.event.inputs.release_type == 'internal' && secrets.APT_S3_IAM_ARN_STAGING || '' }}
+          APT_S3_ACCESS_KEY_ID: ${{ github.event.inputs.release_type == 'public' && secrets.APT_S3_ACCESS_KEY_ID || '' }}
+          APT_S3_SECRET_ACCESS_KEY: ${{ github.event.inputs.release_type == 'public' && secrets.APT_S3_SECRET_ACCESS_KEY || '' }}
 
       - name: Merge back to release branch
         id: merge-back