diff --git a/.github/workflows/burrito-release.yaml b/.github/workflows/burrito-release.yaml
index f815e8b..06a84f9 100644
--- a/.github/workflows/burrito-release.yaml
+++ b/.github/workflows/burrito-release.yaml
@@ -86,6 +86,18 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh release upload "${{ inputs.tag_name }}" app/burrito_out/* --clobber
         working-directory: .
+      -
+        # release-please creates this as a draft (see
+        # .release-please-config.json) specifically so assets can still be
+        # attached above - GitHub's Immutable Releases (GA since Oct 2025)
+        # locks a *published* release's assets the moment it's created, and
+        # this build takes ~10 minutes, well past that point. Publish only
+        # now that every asset has actually landed.
+        name: Publish the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release edit "${{ inputs.tag_name }}" --draft=false
+        working-directory: .
 
   container:
     name: Build and publish container image
diff --git a/.release-please-config.json b/.release-please-config.json
index 5b6fc0d..536962d 100644
--- a/.release-please-config.json
+++ b/.release-please-config.json
@@ -5,7 +5,7 @@
       "release-type": "simple",
       "bump-minor-pre-major": true,
       "bump-patch-for-minor-pre-major": true,
-      "draft": false,
+      "draft": true,
       "prerelease": false,
       "version-file": ".version.txt",
       "extra-files": [