diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index eb00f3c..18250cb 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -8,7 +8,7 @@ permissions:
   contents: write
 
 jobs:
-  build-and-upload:
+  build:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -33,6 +33,26 @@ jobs:
           make release VERSION="$VERSION" PRERELEASE="$PRERELEASE"
           make release-cloud VERSION="$VERSION" PRERELEASE="$PRERELEASE"
 
+      # Shared between the upload and tap-publish jobs so neither has to
+      # rebuild — lets a failed "Upload artifacts to release" run be
+      # retried on its own without re-running the whole build.
+      - name: Stash dist/ for downstream jobs
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 1
+
+  upload-release:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download dist/
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
       - name: Upload artifacts to release
         env:
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -47,11 +67,30 @@ jobs:
               "${api}?name=${name}"
           done
 
-      # Homebrew/Linuxbrew tap + Scoop bucket: only for stable releases —
-      # a prerelease shouldn't become what `brew install`/`scoop install`
-      # resolve to by default. See .gitea/scripts/publish-tap.sh.
+  # Homebrew/Linuxbrew tap + Scoop bucket: only for stable releases — a
+  # prerelease shouldn't become what `brew install`/`scoop install` resolve
+  # to by default. See .gitea/scripts/publish-tap.sh.
+  #
+  # Runs independently of upload-release's outcome (needs it only for
+  # ordering, not success) so a flaky asset upload doesn't block the tap
+  # from getting published. publish-tap.sh is idempotent — it no-ops if
+  # the tap is already at this version — so retrying upload-release later
+  # won't re-trigger a duplicate tap push.
+  publish-tap:
+    needs: [build, upload-release]
+    if: always() && needs.build.result == 'success' && gitea.event.release.prerelease != true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download dist/
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
       - name: Publish Homebrew/Scoop tap
-        if: gitea.event.release.prerelease != true
         env:
           VERSION: ${{ gitea.event.release.tag_name }}
           TAP_TOKEN: ${{ secrets.TAP_TOKEN }}