diff --git a/.github/workflows/finalize-release.yml b/.github/workflows/finalize-release.yml
index c41252a497..7e864545ad 100644
--- a/.github/workflows/finalize-release.yml
+++ b/.github/workflows/finalize-release.yml
@@ -71,7 +71,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1453f0f476..7cebbae25b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -100,7 +100,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
@@ -173,7 +175,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
@@ -233,7 +237,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
@@ -282,7 +288,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
@@ -401,7 +409,9 @@ jobs:
           NPM_CONFIG_PREFER_OFFLINE: 'true'
         run: |-
           npm ci --ignore-scripts --no-audit --progress=false
-          # Run only the repository-owned install steps skipped above.
+          # Replay the root postinstall (patch-package) and commit-info
+          # generation; dependency and workspace lifecycle scripts remain
+          # disabled.
           npm run postinstall
           npm run generate
 
@@ -443,8 +453,11 @@ jobs:
             git commit -m "chore(release): ${RELEASE_TAG}"
           fi
           if [[ "${IS_DRY_RUN}" == "false" ]]; then
-            # Restore the bot PAT only at the push boundary so dependency
-            # installation and build tooling cannot read write credentials.
+            # Restore the bot PAT in this step rather than persisting it in
+            # git credentials at checkout, so dependency installation and
+            # build tooling in earlier steps cannot read write credentials.
+            # The push itself needs the PAT (not the job token): pushes made
+            # with GITHUB_TOKEN do not trigger downstream CI workflows.
             # Export (not inline) so GH_TOKEN is still set when `git push`
             # invokes the credential helper, which re-resolves the token at
             # push time rather than at `gh auth setup-git` time.
diff --git a/scripts/tests/ai-release-notes-workflow.test.js b/scripts/tests/ai-release-notes-workflow.test.js
index 93b5dc6843..3620b804c6 100644
--- a/scripts/tests/ai-release-notes-workflow.test.js
+++ b/scripts/tests/ai-release-notes-workflow.test.js
@@ -112,6 +112,9 @@ describe('stable release notes workflow', () => {
     expect(changelog).not.toContain('continue-on-error: true');
     expect(changelog).toContain("GH_TOKEN: '${{ secrets.CI_BOT_PAT }}'");
     expect(changelog).toContain('gh auth setup-git');
+    expect(changelog.indexOf('gh auth setup-git')).toBeLessThan(
+      changelog.indexOf('git push origin "${BRANCH_NAME}"'),
+    );
   });
 
   it('updates the changelog before opening the release PR', () => {
diff --git a/scripts/tests/package-scripts.test.js b/scripts/tests/package-scripts.test.js
index c2e23c6192..b9cb2e433c 100644
--- a/scripts/tests/package-scripts.test.js
+++ b/scripts/tests/package-scripts.test.js
@@ -446,9 +446,14 @@ describe('package scripts', () => {
     const exportTokenIdx = commitStep.indexOf(
       'export GH_TOKEN="${CI_BOT_PAT}"',
     );
-    expect(
-      commitStep.indexOf('gh auth setup-git', exportTokenIdx),
-    ).toBeGreaterThan(exportTokenIdx);
+    const setupGitIdx = commitStep.indexOf(
+      'gh auth setup-git',
+      exportTokenIdx,
+    );
+    expect(setupGitIdx).toBeGreaterThan(exportTokenIdx);
+    expect(setupGitIdx).toBeLessThan(
+      commitStep.indexOf('git push --force --set-upstream'),
+    );
     expect(buildStep).toContain('npm run build\n          npm run bundle');
   });