diff --git a/.github/workflows/publish-canary.yml b/.github/workflows/publish-canary.yml
deleted file mode 100644
index f04bf20..0000000
--- a/.github/workflows/publish-canary.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: Publish Canary
-on:
-  schedule:
-    - cron: '0 8 * * *'
-  workflow_dispatch:
-
-jobs:
-  publish-canary:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write # Needed for npm provenance
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 18
-          registry-url: https://registry.npmjs.org/
-
-      - name: Get current date
-        id: date
-        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
-
-      - name: Get current version
-        id: version
-        run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
-
-      - name: Set canary version
-        id: canary-version
-        run: echo "version=${{ steps.version.outputs.version }}-alpha-${{ steps.date.outputs.date }}" >> $GITHUB_OUTPUT
-
-      - name: Update package.json version
-        run: |
-          npm version ${{ steps.canary-version.outputs.version }} --no-git-tag-version
-
-      - run: npm ci
-      - run: npx playwright install --with-deps
-      - run: npm run lint
-      - run: npm run ctest
-
-      - name: Publish to npm with next tag
-        run: npm publish --tag next --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Reset package.json version
-        run: git checkout -- package.json
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 13973d3..dbb133f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,18 +1,68 @@
 name: Publish
 on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 8 * * *'
   release:
     types: [published]
+
 jobs:
-  publish-npm:
+  publish-canary-npm:
+    if: github.event.schedule || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write  # Required for OIDC
+      id-token: write  # Required for OIDC npm publishing
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
-          node-version: 18
+          node-version: 20
+          registry-url: https://registry.npmjs.org/
+      # Ensure npm 11.5.1 or later is installed (for OIDC npm publishing)
+      - name: Update npm
+        run: npm install -g npm@latest
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+      - name: Get current version
+        id: version
+        run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
+
+      - name: Set canary version
+        id: canary-version
+        run: echo "version=${{ steps.version.outputs.version }}-alpha-${{ steps.date.outputs.date }}" >> $GITHUB_OUTPUT
+
+      - name: Update package.json version
+        run: |
+          npm version ${{ steps.canary-version.outputs.version }} --no-git-tag-version
+
+      - run: npm ci
+      - run: npx playwright install --with-deps
+      - run: npm run lint
+      - run: npm run ctest
+
+      - name: Publish to npm with next tag
+        run: npm publish --tag next
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Reset package.json version
+        run: git checkout -- package.json
+
+  publish-release-npm:
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # Required for OIDC npm publishing
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 20
           registry-url: https://registry.npmjs.org/
       # Ensure npm 11.5.1 or later is installed (for OIDC npm publishing)
       - name: Update npm
@@ -23,14 +73,15 @@ jobs:
       - run: npm run ctest
       - run: npm publish
 
-  publish-docker:
+  publish-release-docker:
+    if: github.event_name == 'release'
     runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write # Needed for OIDC login to Azure
     environment: allow-publishing-docker-to-acr
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up QEMU # Needed for multi-platform builds (e.g., arm64 on amd64 runner)
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx # Needed for multi-platform builds
@@ -69,13 +120,14 @@ jobs:
             attach_eol_manifest $tag
           done
 
-  package-extension:
+  package-release-extension:
+    if: github.event_name == 'release'
     runs-on: ubuntu-latest
     permissions:
       contents: write # Needed to upload release assets
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: 20
           cache: 'npm'