diff --git a/.github/workflows/java-publish-maven.yml b/.github/workflows/java-publish-maven.yml
index 03c9136ab..a465ebea1 100644
--- a/.github/workflows/java-publish-maven.yml
+++ b/.github/workflows/java-publish-maven.yml
@@ -32,8 +32,36 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  preflight:
+    name: Preflight checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify GITHUB_TOKEN can create releases
+        run: |
+          # Test that the token has contents:write by checking repo permissions
+          PERMS=$(gh api repos/${{ github.repository }} --jq '.permissions.push // false')
+          if [ "$PERMS" != "true" ]; then
+            echo "::error::GITHUB_TOKEN lacks push/write permission on this repository. GitHub Release creation will fail."
+            exit 1
+          fi
+          echo "GITHUB_TOKEN permissions OK"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Verify JAVA_RELEASE_GITHUB_TOKEN is valid
+        run: |
+          # Test that the token can authenticate and trigger workflows
+          USER=$(gh api user --jq '.login' 2>&1) || {
+            echo "::error::JAVA_RELEASE_GITHUB_TOKEN is invalid or expired. Changelog trigger will fail."
+            exit 1
+          }
+          echo "JAVA_RELEASE_GITHUB_TOKEN is valid (authenticated as: ${USER})"
+        env:
+          GITHUB_TOKEN: ${{ secrets.JAVA_RELEASE_GITHUB_TOKEN }}
+
   publish-maven:
     name: Publish Java SDK to Maven Central
+    needs: preflight
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -177,7 +205,7 @@ jobs:
 
   github-release:
     name: Create GitHub Release
-    needs: publish-maven
+    needs: [preflight, publish-maven]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     defaults:
diff --git a/.github/workflows/java.notes.template b/.github/workflows/java.notes.template
index bec50a91b..d34d39c62 100644
--- a/.github/workflows/java.notes.template
+++ b/.github/workflows/java.notes.template
@@ -1,10 +1,11 @@
+<!-- INSTALLATION_SECTION: preserve this section verbatim when updating release notes -->
+<!-- maven_central_url: https://central.sonatype.com/artifact/${GROUP_ID}/${ARTIFACT_ID}/${VERSION} -->
 # Installation
 
-ℹ️ **Public Preview:** This is the official Java SDK for GitHub Copilot. This repository treats the official .NET and Node.js SDKs for GitHub Copilot as reference implementations. These SDKs are all officially supported as GitHub open source projects. The Java implementation follows the backward compatibility guarantees offered by the reference implementations.
-
 ⚠️ **Artifact versioning plan:** Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form `vMaj.Min.Micro`. For example v0.1.32. The corresponding maven version for the release will be `Maj.Min.Micro-java.N`, where `Maj`, `Min` and `Micro` are the corresponding numbers for the reference implementation release, and `N` is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the `docs/adr` directory of the source code.
-  
+
 📦 [View on Maven Central](https://central.sonatype.com/artifact/${GROUP_ID}/${ARTIFACT_ID}/${VERSION})
+<!-- END_INSTALLATION_SECTION -->
 
 ## Maven
 ```xml
diff --git a/.github/workflows/release-changelog.md b/.github/workflows/release-changelog.md
index d82365ac5..52af777cd 100644
--- a/.github/workflows/release-changelog.md
+++ b/.github/workflows/release-changelog.md
@@ -117,6 +117,11 @@ Use the `create-pull-request` output to submit your changes. The PR should:
 
 Use the `update-release` output to replace the auto-generated release notes with your nicely formatted changelog. **Do not include the version heading** (`## [vX.Y.Z](...) (date)`) in the release notes — the release already has a title showing the version. Start directly with the feature sections or other changes list.
 
+**IMPORTANT — Preserving the Installation section:**
+The release body may contain an Installation section delimited by `<!-- INSTALLATION_SECTION -->` and `<!-- END_INSTALLATION_SECTION -->` HTML comments. In the case of Java, this section includes Maven/Gradle dependency snippets and a "View on Maven Central" link. You **MUST** preserve this entire section (from the opening comment through the closing comment, inclusive) exactly as it appears in the existing release body. Place your generated changelog content **after** the Installation section.
+
+**URL reconstruction:** If the Maven Central URL in the Installation section appears corrupted or contains the word "redacted", reconstruct it. Extract the version from the release tag (e.g., `java/v1.0.0` → `1.0.0`), and rebuild the URL as: `https://central.sonatype.com/artifact/com.github/copilot-sdk-java/{VERSION}`. The `<!-- maven_central_url -->` HTML comment in the section contains the intended URL pattern.
+
 ## Example Output
 
 Here is an example of what a changelog entry should look like, based on real commits from this repo. **Follow this style exactly.**