diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f94d5232..35ed4a6a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -19,6 +19,7 @@ concurrency:
 env:
   PNPM_VERSION: '10.24.0'
   NODE_VERSION: '22'
+  CI_RELEASE_TAG: ci-build-${{ github.run_id }}
 
 jobs:
   # ─────────────────────────────────────────────
@@ -69,6 +70,8 @@ jobs:
     name: macOS (${{ matrix.arch }})
     runs-on: ${{ matrix.runner }}
     needs: test
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -105,20 +108,30 @@ jobs:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-      - uses: actions/upload-artifact@v4
-        with:
-          name: macos-${{ matrix.arch }}
-          path: |
-            build/release/*.dmg
-            build/release/*.zip
-            build/release/*.blockmap
-            build/release/latest-mac.yml
-          if-no-files-found: error
+      - name: Upload release files
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release view "$CI_RELEASE_TAG" >/dev/null 2>&1 || \
+            gh release create "$CI_RELEASE_TAG" \
+              --draft \
+              --prerelease \
+              --title "CI Build $GITHUB_RUN_ID" \
+              --notes "Temporary build artifact transport for Cloudflare publication." \
+              --target "$GITHUB_SHA"
+          gh release upload "$CI_RELEASE_TAG" \
+            build/release/*.dmg \
+            build/release/*.zip \
+            build/release/*.blockmap \
+            build/release/latest-mac.yml \
+            --clobber
 
   build-windows:
     name: Windows (${{ matrix.arch }})
     runs-on: windows-latest
     needs: test
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -144,19 +157,30 @@ jobs:
         env:
           CSC_LINK: ${{ secrets.WIN_CERTIFICATE_P12_BASE64 }}
           CSC_KEY_PASSWORD: ${{ secrets.WIN_CERTIFICATE_PASSWORD }}
-      - uses: actions/upload-artifact@v4
-        with:
-          name: windows-${{ matrix.arch }}
-          path: |
-            build/release/*.exe
-            build/release/*.blockmap
-            build/release/latest.yml
-          if-no-files-found: error
+      - name: Upload release files
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release view "$CI_RELEASE_TAG" >/dev/null 2>&1 || \
+            gh release create "$CI_RELEASE_TAG" \
+              --draft \
+              --prerelease \
+              --title "CI Build $GITHUB_RUN_ID" \
+              --notes "Temporary build artifact transport for Cloudflare publication." \
+              --target "$GITHUB_SHA"
+          gh release upload "$CI_RELEASE_TAG" \
+            build/release/*.exe \
+            build/release/*.blockmap \
+            build/release/latest.yml \
+            --clobber
 
   build-linux:
     name: Linux (${{ matrix.arch }})
     runs-on: ubuntu-latest
     needs: test
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -182,20 +206,27 @@ jobs:
         run: pnpm exec electron-vite build
       - name: Package
         run: pnpm exec electron-builder ${{ matrix.builder_args }} --config electron-builder.yml --publish never
-      - uses: actions/upload-artifact@v4
-        with:
-          name: linux-${{ matrix.arch }}
-          path: |
-            build/release/*.AppImage
-            build/release/*.deb
-            build/release/*.rpm
-            build/release/*.snap
-            build/release/*.blockmap
-            build/release/latest-linux.yml
-          if-no-files-found: warn
+      - name: Upload release files
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release view "$CI_RELEASE_TAG" >/dev/null 2>&1 || \
+            gh release create "$CI_RELEASE_TAG" \
+              --draft \
+              --prerelease \
+              --title "CI Build $GITHUB_RUN_ID" \
+              --notes "Temporary build artifact transport for Cloudflare publication." \
+              --target "$GITHUB_SHA"
+          gh release upload "$CI_RELEASE_TAG" \
+            build/release/*.AppImage \
+            build/release/*.deb \
+            build/release/*.rpm \
+            build/release/*.blockmap \
+            build/release/latest-linux.yml \
+            --clobber
 
   # ─────────────────────────────────────────────
-  # Stage 4: Publish to GitHub Releases
+  # Stage 4: Publish Release
   # ─────────────────────────────────────────────
   release:
     name: Publish Release