diff --git a/.github/workflows/next.yml b/.github/workflows/next.yml
index eeaa2f0a..50aa3041 100644
--- a/.github/workflows/next.yml
+++ b/.github/workflows/next.yml
@@ -28,6 +28,6 @@ jobs:
       target_branch: next
       prerelease: true
       draft_release: true
-      verify_nix: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.source_only == 'true') }}
-      build_platform_artifacts: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.source_only == 'true') }}
+      verify_nix: ${{ !((github.event_name == 'workflow_dispatch' && github.event.inputs.source_only == 'true') || (github.event_name == 'push' && contains(github.event.head_commit.message, '[source-only]'))) }}
+      build_platform_artifacts: ${{ !((github.event_name == 'workflow_dispatch' && github.event.inputs.source_only == 'true') || (github.event_name == 'push' && contains(github.event.head_commit.message, '[source-only]'))) }}
     secrets: inherit
diff --git a/.github/workflows/promote-main-to-next.yml b/.github/workflows/promote-main-to-next.yml
index 8afb8dfe..13034cc9 100644
--- a/.github/workflows/promote-main-to-next.yml
+++ b/.github/workflows/promote-main-to-next.yml
@@ -68,7 +68,11 @@ jobs:
             exit 0
           fi
           NEW_VERSION="$(node -p 'require("./package.json").version')"
-          git commit -m "chore(release): bump next channel to ${NEW_VERSION}"
+          MSG="chore(release): bump next channel to ${NEW_VERSION}"
+          if [[ "${{ inputs.source_only }}" == "true" ]]; then
+            MSG="${MSG} [source-only]"
+          fi
+          git commit -m "$MSG"
       - name: push next
         run: git push --force-with-lease origin HEAD:next
       - name: dispatch Next Channel workflow
diff --git a/.github/workflows/promote-next-to-release.yml b/.github/workflows/promote-next-to-release.yml
index ca8bbb77..9a5719a3 100644
--- a/.github/workflows/promote-next-to-release.yml
+++ b/.github/workflows/promote-next-to-release.yml
@@ -53,7 +53,11 @@ jobs:
             exit 0
           fi
           NEW_VERSION="$(node -p 'require("./package.json").version')"
-          git commit -m "chore(release): finalize release version ${NEW_VERSION}"
+          MSG="chore(release): finalize release version ${NEW_VERSION}"
+          if [[ "${{ inputs.source_only }}" == "true" ]]; then
+            MSG="${MSG} [source-only]"
+          fi
+          git commit -m "$MSG"
       - name: push release
         run: git push --force-with-lease origin HEAD:release
       - name: dispatch Release Channel workflow
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7523f0e7..9b5020d0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,6 +25,6 @@ jobs:
       target_branch: release
       prerelease: false
       draft_release: true
-      verify_nix: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.source_only == 'true') }}
-      build_platform_artifacts: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.source_only == 'true') }}
+      verify_nix: ${{ !((github.event_name == 'workflow_dispatch' && github.event.inputs.source_only == 'true') || (github.event_name == 'push' && contains(github.event.head_commit.message, '[source-only]'))) }}
+      build_platform_artifacts: ${{ !((github.event_name == 'workflow_dispatch' && github.event.inputs.source_only == 'true') || (github.event_name == 'push' && contains(github.event.head_commit.message, '[source-only]'))) }}
     secrets: inherit
diff --git a/.github/workflows/reusable-channel-publish.yml b/.github/workflows/reusable-channel-publish.yml
index df7f9a1e..ed0e8297 100644
--- a/.github/workflows/reusable-channel-publish.yml
+++ b/.github/workflows/reusable-channel-publish.yml
@@ -166,6 +166,14 @@ jobs:
             const targetCommitish = process.env.RELEASE_COMMIT_SHA;
             const name = `Psysonic v${version}`;
             let releaseId = null;
+
+            if (!tag || !/^app-v\d+\.\d+\.\d+/.test(tag)) {
+              throw new Error(`Invalid RELEASE_TAG '${tag ?? ""}'`);
+            }
+            if (!targetCommitish || !/^[0-9a-f]{40}$/i.test(targetCommitish)) {
+              throw new Error(`Invalid RELEASE_COMMIT_SHA '${targetCommitish ?? ""}'`);
+            }
+
             try {
               const { data } = await github.rest.repos.getReleaseByTag({
                 owner: context.repo.owner,
@@ -198,6 +206,19 @@ jobs:
               releaseId = data.id;
               core.info(`Created release id=${releaseId} tag=${tag} target_commitish=${targetCommitish}`);
             }
+
+            // Canonicalize release_id by querying the expected tag directly.
+            // This prevents passing a mismatched/untagged release id to later jobs.
+            const { data: byTag } = await github.rest.repos.getReleaseByTag({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              tag,
+            });
+            if (!byTag.tag_name || byTag.tag_name.startsWith("untagged-")) {
+              throw new Error(`Release fetched by tag '${tag}' is untagged ('${byTag.tag_name ?? ""}')`);
+            }
+            releaseId = byTag.id;
+            core.info(`Resolved canonical release id=${releaseId} by tag=${tag}`);
             core.setOutput("release_id", String(releaseId));
       - name: validate release id output
         env: