diff --git a/.github/workflows/anneal-release.yml b/.github/workflows/anneal-release.yml
index d316deccdb..53a9eb4656 100644
--- a/.github/workflows/anneal-release.yml
+++ b/.github/workflows/anneal-release.yml
@@ -202,6 +202,7 @@ jobs:
             --target "$BASE_SHA" \
             --title "$TAG_NAME" \
             --notes "Machine-generated Anneal toolchain artifacts for cargo-anneal ${VERSION}, built from ${BASE_SHA} after applying the generated release version-bump patch." \
+            --draft \
             --prerelease \
             --latest=false
           echo "tag_name=${TAG_NAME}" >> "$GITHUB_OUTPUT"
@@ -431,3 +432,12 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ steps.submit-pr-fork.outputs.pull-request-number }}
         run: gh pr edit "$PR_NUMBER" --add-label "hide-from-release-notes"
+
+      - name: Publish toolchain artifact release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          TAG_NAME: ${{ needs.create-release.outputs.tag_name }}
+        run: |
+          set -eo pipefail
+          gh release edit "$TAG_NAME" --repo "$GH_REPO" --draft=false
diff --git a/anneal/tools/check-release-flow-dry-run.sh b/anneal/tools/check-release-flow-dry-run.sh
index 118e4057b2..bab19fee67 100644
--- a/anneal/tools/check-release-flow-dry-run.sh
+++ b/anneal/tools/check-release-flow-dry-run.sh
@@ -139,4 +139,31 @@ for os_name, arch in sorted(expected):
         raise SystemExit(f"invalid URL for {os_name}.{arch}: {url!r}")
 PY
 
+python3 - <<'PY'
+import pathlib
+
+workflow = pathlib.Path(".github/workflows/anneal-release.yml").read_text(encoding="utf-8")
+
+create_release = 'gh release create "$TAG_NAME"'
+if create_release not in workflow:
+    raise SystemExit("release workflow no longer creates a toolchain release with TAG_NAME")
+
+create_release_index = workflow.index(create_release)
+publish_release_index = workflow.find('gh release edit "$TAG_NAME"')
+if publish_release_index == -1:
+    raise SystemExit("release workflow must publish the draft toolchain release after uploads succeed")
+if publish_release_index < create_release_index:
+    raise SystemExit("release workflow publishes the toolchain release before creating it")
+
+create_release_block = workflow[create_release_index:publish_release_index]
+if "--draft" not in create_release_block:
+    raise SystemExit(
+        "toolchain release must be created as a draft so GitHub immutable releases still allow asset uploads"
+    )
+
+publish_release_block = workflow[publish_release_index:publish_release_index + 500]
+if "--draft=false" not in publish_release_block:
+    raise SystemExit("toolchain release publish step must pass --draft=false")
+PY
+
 echo "Anneal release dry-run checks passed."