diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 352f847..6b52b2c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -48,5 +48,13 @@ jobs:
     - name: Testing
       run: pnpm test:ci
 
-    - name: Publish
-      run: pnpm publish --provenance --no-git-checks --ignore-scripts --access public
+    - name: Pack
+      run: |
+        mkdir -p packed
+        pnpm pack --pack-destination packed
+        ls -la packed
+
+    - name: Stage publish
+      # pnpm ≥ 11.3. --no-git-checks: git-checks run even for a tarball and
+      # fail on a detached release-tag checkout and on the untracked pack output.
+      run: pnpm stage publish ./packed/*.tgz --access public --provenance --no-git-checks
diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md
index a580bd4..171a1e9 100644
--- a/DEFENSE_IN_DEPTH.md
+++ b/DEFENSE_IN_DEPTH.md
@@ -31,12 +31,12 @@ Profile: npm library · public
 - [x] Workflow `name:` and job `name:` contain no spaces (kebab-case) so they can be set as required status checks — verified 2026-09-09
 - [x] `persist-credentials: false` on checkouts that don't push — PR #72
 - [x] No `pull_request_target` on workflows that run untrusted PR code — verified 2026-09-09
-- [ ] Artifact-publishing workflows disable `actions/setup-node` default caching (`package-manager-cache: false`) to prevent cache poisoning (PR #73 pending)
-- [ ] No npm tokens (or other registry credentials) in Actions secrets
+- [x] Artifact-publishing workflows disable `actions/setup-node` default caching (`package-manager-cache: false`) to prevent cache poisoning — PR #73
+- [ ] No npm tokens (or other registry credentials) in Actions secrets — workflows have no NPM_TOKEN/NODE_AUTH_TOKEN refs; Actions secrets could not be listed (403)
 
 ## 5. npm publishing — npm libraries only
 - [ ] OIDC trusted publishing configured **stage-only** on npmjs.com for the publish workflow — it can stage, never publish live (manual)
-- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks`
+- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` (PR #74 pending)
 - [ ] Maintainer promotes staged versions with 2FA (manual)
 - [ ] Drydock connected — staged releases reviewed before promotion (manual)
 - [ ] No direct publish rights: package requires 2FA and disallows tokens (manual)
diff --git a/SECURITY.md b/SECURITY.md
index 2d6be0d..17e0f35 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -27,6 +27,7 @@ hardening checklist; progress is tracked in [DEFENSE_IN_DEPTH.md](./DEFENSE_IN_D
 - Dependencies install through pnpm with a 7-day cooldown on new versions, lifecycle scripts blocked by default, `trustPolicy: no-downgrade`, and exotic subdependencies blocked.
 - The lockfile is committed and CI installs with `--frozen-lockfile`. There is no Dependabot config; dependency updates go through reviewed PRs.
 - CI workflows default to read-only `contents: read` permissions; generated output is never committed back from CI; every action is pinned to a full commit SHA; Socket Firewall (`sfw`) wraps `pnpm install`; zizmor lints workflows on every PR; checkouts that do not push set `persist-credentials: false`.
+- The release workflow disables `setup-node` package-manager caching.
 - Workflows do not use `pull_request_target`.
 - The published package sets `repository.url` to this repo so provenance can map back.
 - `.github/CODEOWNERS` names `@jaredwray` for `/.github/`, `/.vscode/`, `/.cursor/`, `/.devcontainer/`, and `/scripts/`.