diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c42fe1a7..7a6347cb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -143,9 +143,18 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          # Release is a draft (release-please-config.json) so `latest` never
+          # points at it until every asset is attached — avoids a 404 window.
           TAG="${{ needs.release-please.outputs.tag_name }}"
           if [ -z "$TAG" ]; then
-            TAG="$(gh release list --limit 1 --json tagName --jq '.[0].tagName')"
+            # publish_only retry path has no tag_name: pick the newest *draft*
+            # only (never a published release) and fail fast if none exists.
+            TAG="$(gh release list --limit 30 --json tagName,isDraft \
+              --jq 'map(select(.isDraft)) | .[0].tagName // empty')"
+            if [ -z "$TAG" ]; then
+              echo "No draft release found to publish." >&2
+              exit 1
+            fi
           fi
           gh release upload "$TAG" \
             dist/gddy-*.tar.gz \
@@ -154,3 +163,5 @@ jobs:
             install.sh \
             install.ps1 \
             --clobber
+          # Publish only now assets are complete; stays a draft if build fails.
+          gh release edit "$TAG" --draft=false --latest
diff --git a/release-please-config.json b/release-please-config.json
index ba79cefd..8fa52e5d 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -19,7 +19,8 @@
     "rust": {
       "release-type": "rust",
       "component": "gddy",
-      "include-component-in-tag": false
+      "include-component-in-tag": false,
+      "draft": true
     }
   }
 }