diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a81d62fa..97c9fbb6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -92,6 +92,12 @@ jobs:
           ref: ${{ needs.meta.outputs.tag }}
           fetch-depth: 0
 
+      - name: Stamp package version from tag
+        shell: bash
+        run: node scripts/bump-version.mjs "${TAG#v}"
+        env:
+          TAG: ${{ needs.meta.outputs.tag }}
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v5
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a975301f..e8c7232f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,12 +50,12 @@ jobs:
         run: |
           set -o pipefail
           npx semantic-release --dry-run 2>&1 | tee /tmp/sr-dry.log
-          if grep -qE "There are no relevant changes" /tmp/sr-dry.log; then
+          if grep -qE '\[semantic-release\].*There are no relevant changes, so no new version is released' /tmp/sr-dry.log; then
             echo "No release to cut from this push."
             echo "released=false" >> "$GITHUB_ENV"
             exit 0
           fi
-          if ! grep -qE "next release version is" /tmp/sr-dry.log; then
+          if ! grep -qE '\[semantic-release\].*The next release version is [0-9]+\.[0-9]+\.[0-9]+' /tmp/sr-dry.log; then
             echo "::error::semantic-release dry-run did not announce a next release version."
             exit 1
           fi
@@ -71,19 +71,17 @@ jobs:
           GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
         run: npx semantic-release
 
-      - name: Verify version bump
+      - name: Record tag
         if: env.released == 'true'
         run: |
-          expected=$(grep -oE "next release version is [0-9]+\.[0-9]+\.[0-9]+" /tmp/sr-dry.log \
-                     | tail -n 1 | awk '{print $NF}')
-          root_v=$(jq -r .version package.json)
-          desk_v=$(jq -r .version apps/desktop/package.json)
-          if [ "$root_v" != "$expected" ] || [ "$desk_v" != "$expected" ]; then
-            echo "::error::Version mismatch after semantic-release. Expected $expected, got root=$root_v desktop=$desk_v"
+          expected=$(grep -oE '\[semantic-release\].*The next release version is [0-9]+\.[0-9]+\.[0-9]+' /tmp/sr-dry.log \
+                     | tail -n 1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+$')
+          if [ -z "$expected" ]; then
+            echo "::error::Could not read next version from dry-run log."
             exit 1
           fi
           echo "v$expected" > version.txt
-          echo "Version bump verified: $expected"
+          echo "Will tag v$expected (package.json stays on git; Build bumps before packaging)."
 
       - name: Attach What's New
         if: env.released == 'true'
diff --git a/CLAUDE.md b/CLAUDE.md
index a0c9e47d..abffd85c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -333,4 +333,4 @@ Renderer (AiPanel) → IPC → Main (ipc-ai.ts) → AIService → ProviderRegist
 - **Package docs:** `packages/*/README.md`
 - **Technical docs:** `apps/docs-site/`
 - **Live docs:** https://dripnex.app/docs
-- **GitHub:** https://github.com/dripnex/readide
+- **GitHub:** https://github.com/dripnex/app
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0d789c1f..de67ba16 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -84,7 +84,7 @@ pnpm build            # Build all packages
 
 ## Questions?
 
-- Open a [GitHub Discussion](https://github.com/dripnex/readide/discussions)
+- Open a [GitHub Discussion](https://github.com/dripnex/app/discussions)
 - Check existing issues before creating new ones
 
 ## License
diff --git a/README.md b/README.md
index 974d2ad7..b191980b 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 Markdown-first, offline-forever desktop note app.
 
 [![License: MIT](https://img.shields.io/badge/Core-MIT-green.svg)](./LICENSE)
-[![Release](https://img.shields.io/github/v/release/dripnex/readide)](https://github.com/dripnex/readide/releases)
+[![Release](https://img.shields.io/github/v/release/dripnex/app)](https://github.com/dripnex/app/releases)
 
 ## About
 
@@ -13,8 +13,8 @@ This repository contains the **open-source core** of Dripnex. Core packages are
 
 ```bash
 # Clone
-git clone https://github.com/dripnex/readide.git
-cd readide
+git clone https://github.com/dripnex/app.git
+cd app
 
 # Install
 pnpm install
@@ -43,7 +43,7 @@ See [CONTRIBUTING.md](./CONTRIBUTING.md) for guidelines.
 
 - [Website](https://dripnex.app)
 - [Documentation](https://dripnex.app/docs)
-- [Releases](https://github.com/dripnex/readide/releases)
+- [Releases](https://github.com/dripnex/app/releases)
 
 ## License
 
diff --git a/apps/desktop/RELEASES.md b/apps/desktop/RELEASES.md
index 10bc48b6..7bf674a6 100644
--- a/apps/desktop/RELEASES.md
+++ b/apps/desktop/RELEASES.md
@@ -6,7 +6,7 @@ packaged-app checklist that CI cannot run.
 
 ## Auto-updater
 
-- **Repository**: `dripnex/readide`
+- **Repository**: `dripnex/app`
 - **Channel**: GitHub Releases (stable tags `vX.Y.Z`)
 - **Auto-download**: no (asks first)
 - **Auto-install**: yes (on quit)
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index f131c7e3..ac94387d 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -180,7 +180,7 @@
     "publish": {
       "provider": "github",
       "owner": "dripnex",
-      "repo": "readide"
+      "repo": "app"
     }
   }
 }
diff --git a/docs/RELEASE.md b/docs/RELEASE.md
index 258de1ab..915b68d7 100644
--- a/docs/RELEASE.md
+++ b/docs/RELEASE.md
@@ -31,9 +31,10 @@ CI on that PR is the gate. When it merges:
 
 - **Release** runs on `main`.
 - It reads commits since the last tag (`feat` → minor, `fix` → patch).
-- It bumps `package.json` + `apps/desktop/package.json`, writes `CHANGELOG.md`,
-  tags `vX.Y.Z`, opens a **draft** GitHub Release. If the What’s New file
-  exists, that body replaces the commit dump.
+- It tags `vX.Y.Z` on the merge SHA and opens a **draft** GitHub Release.
+  It does **not** push a version-bump commit to `main` (branch rules require
+  a PR). Build stamps `package.json` from the tag right before packaging.
+  If `docs/releases/vX.Y.Z.md` exists, that body is the GitHub notes.
 - **Build & Publish** starts from that success (not from the tag push — GitHub
   will not let `GITHUB_TOKEN` trigger another workflow via tags).
 - All three platforms green → the release is published → electron-updater sees
@@ -53,7 +54,7 @@ gh workflow run "Build & Publish" -f tag=v0.16.0
 
 | What we did                        | What actually happened                                    |
 | ---------------------------------- | --------------------------------------------------------- |
-| PAT `GH_TOKEN` as `tomymaritano`   | 403 on `dripnex/readide`. Tokens expire. Bots do not.     |
+| PAT `GH_TOKEN` as `tomymaritano`   | 403. Tokens expire. Bots do not.                          |
 | **Run workflow** by hand           | Easy to forget. 0.16.0 sat on `main` with no tag.         |
 | Squash the promotion PR            | All `feat` commits vanish. No minor bump.                 |
 | Title `feat(release): cut v0.15.x` | One fake Feature. The real changelog is a single line.    |
diff --git a/package.json b/package.json
index e78f2fb3..581d9937 100644
--- a/package.json
+++ b/package.json
@@ -12,10 +12,10 @@
   "homepage": "https://dripnex.app",
   "repository": {
     "type": "git",
-    "url": "https://github.com/dripnex/readide.git"
+    "url": "https://github.com/dripnex/app.git"
   },
   "bugs": {
-    "url": "https://github.com/dripnex/readide/issues"
+    "url": "https://github.com/dripnex/app/issues"
   },
   "keywords": [
     "markdown",
diff --git a/release.config.js b/release.config.js
index cdd722cd..57689e9c 100644
--- a/release.config.js
+++ b/release.config.js
@@ -1,4 +1,5 @@
 export default {
+  repositoryUrl: 'https://github.com/dripnex/app.git',
   branches: ['main', { name: 'beta', prerelease: true }],
   plugins: [
     [
@@ -31,26 +32,10 @@ export default {
         },
       },
     ],
-    '@semantic-release/changelog',
-    // The @semantic-release/git plugin below only COMMITS files; it does
-    // not mutate them. Without this exec step, package.json and
-    // apps/desktop/package.json stay at the previous version even after
-    // tag/release (the v0.15.0 bug). bump-version.mjs is a pure-ESM,
-    // zero-dependency script that only touches the `version` field of
-    // exactly the two files in scope.
-    [
-      '@semantic-release/exec',
-      {
-        prepareCmd: 'node scripts/bump-version.mjs ${nextRelease.version}',
-      },
-    ],
-    [
-      '@semantic-release/git',
-      {
-        assets: ['CHANGELOG.md', 'package.json', 'apps/desktop/package.json'],
-        message: 'chore(release): v${nextRelease.version} [skip ci]',
-      },
-    ],
+    // Do not commit version bumps to main. Branch rules require a PR;
+    // github-actions cannot push HEAD:main. The tag points at the merge
+    // SHA; Build & Publish runs bump-version.mjs from the tag name before
+    // electron-builder so the binary version is still correct.
     [
       '@semantic-release/github',
       {