diff --git a/.github/workflows/compute-matrix.yaml b/.github/workflows/compute-matrix.yaml
index 8f0f3963..2c352d6e 100644
--- a/.github/workflows/compute-matrix.yaml
+++ b/.github/workflows/compute-matrix.yaml
@@ -2,7 +2,7 @@ on:
   workflow_call:
     inputs:
       build_type:
-        description: "One of: [branch, nightly, pull-request]"
+        description: "One of: [branch, nightly, pull-request, release-candidate]"
         required: true
         type: string
       matrix_name:
@@ -10,7 +10,7 @@ on:
         required: true
         type: string
       matrix_type:
-        description: "One of: [auto, nightly, pull-request]. 'auto' means 'choose a value based on what's provided via build_type'."
+        description: "One of: [auto, nightly, pull-request, release-candidate]. 'auto' means 'choose a value based on what's provided via build_type'."
         required: false
         type: string
         default: "auto"
@@ -65,6 +65,7 @@ jobs:
               - { ARCH: 'arm64', PY_VER: '3.11', CUDA_VER: '12.9.2', LINUX_VER: 'rockylinux8' }
               - { ARCH: 'arm64', PY_VER: '3.11', CUDA_VER: '13.3.0', LINUX_VER: 'rockylinux8' }
             nightly: *conda_cpp_build
+            release-candidate: *conda_cpp_build
 
           conda-cpp-tests:
             pull-request:
@@ -115,6 +116,7 @@ jobs:
               - { ARCH: 'arm64', PY_VER: '3.13', CUDA_VER: '13.3.0', LINUX_VER: 'rockylinux8' }
               - { ARCH: 'arm64', PY_VER: '3.14', CUDA_VER: '13.3.0', LINUX_VER: 'rockylinux8' }
             nightly: *conda_python_build
+            release-candidate: *conda_python_build
 
           conda-python-tests:
             pull-request:
@@ -166,6 +168,7 @@ jobs:
               - { ARCH: 'arm64', PY_VER: '3.13', CUDA_VER: '13.3.0', LINUX_VER: 'rockylinux8' }
               - { ARCH: 'arm64', PY_VER: '3.14', CUDA_VER: '13.3.0', LINUX_VER: 'rockylinux8' }
             nightly: *wheels_build
+            release-candidate: *wheels_build
 
           wheels-test:
             pull-request:
@@ -200,12 +203,12 @@ jobs:
         env:
           MATRIX: ${{ steps.prepare-matrix.outputs.matrix }}
         run: |
-          if [[ "$BUILD_TYPE" != "branch" ]] && [[ "$BUILD_TYPE" != "nightly" ]] && [[ "$BUILD_TYPE" != "pull-request" ]]; then
-              echo "Invalid build_type! Must be one of 'branch', 'nightly', or 'pull-request'."
+          if [[ "$BUILD_TYPE" != "branch" ]] && [[ "$BUILD_TYPE" != "nightly" ]] && [[ "$BUILD_TYPE" != "pull-request" ]] && [[ "$BUILD_TYPE" != "release-candidate" ]]; then
+              echo "Invalid build_type! Must be one of 'branch', 'nightly', 'pull-request', or 'release-candidate'."
               exit 1
           fi
-          if [[ "$MATRIX_TYPE" != "auto" ]] && [[ "$MATRIX_TYPE" != "nightly" ]] && [[ "$MATRIX_TYPE" != "pull-request" ]]; then
-              echo "Invalid matrix_type! Must be one of 'auto', 'nightly', or 'pull-request'."
+          if [[ "$MATRIX_TYPE" != "auto" ]] && [[ "$MATRIX_TYPE" != "nightly" ]] && [[ "$MATRIX_TYPE" != "pull-request" ]] && [[ "$MATRIX_TYPE" != "release-candidate" ]]; then
+              echo "Invalid matrix_type! Must be one of 'auto', 'nightly', 'pull-request', or 'release-candidate'."
               exit 1
           fi
           if ! jq -n -e '$ENV.MATRIX | fromjson | has($ENV.MATRIX_NAME)'; then
diff --git a/.github/workflows/conda-cpp-build.yaml b/.github/workflows/conda-cpp-build.yaml
index 4f8a4461..e10cb4f0 100644
--- a/.github/workflows/conda-cpp-build.yaml
+++ b/.github/workflows/conda-cpp-build.yaml
@@ -2,7 +2,7 @@ on:
   workflow_call:
     inputs:
       build_type:
-        description: "One of: [branch, nightly, pull-request]"
+        description: "One of: [branch, nightly, pull-request, release-candidate]"
         required: true
         type: string
       branch:
@@ -44,6 +44,14 @@ on:
         default: true
         required: false
         description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store"
+      candidate-train-sha256:
+        description: "Canonical SHA-256 of the release train; required for release-candidate builds."
+        type: string
+        default: ""
+      release-candidate-tag:
+        description: "Final source tag created locally for a release-candidate build; it is never pushed."
+        type: string
+        default: ""
       matrix_filter:
         description: |
           jq expression which modifies the matrix.
@@ -109,6 +117,7 @@ jobs:
       image: rapidsai/ci-conda:26.10-cuda${{ matrix.CUDA_VER }}-${{ matrix.LINUX_VER }}-py${{ matrix.PY_VER }}
       env:
         RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}
+        RAPIDS_RELEASE_CANDIDATE: ${{ inputs.build_type == 'release-candidate' }}
         RAPIDS_DATETIME_STRING: ${{ inputs.build-datetime }}
     steps:
       - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
@@ -122,6 +131,16 @@ jobs:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
           persist-credentials: true
+      - name: Create local release-candidate tag
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        env:
+          RELEASE_CANDIDATE_TAG: ${{ inputs.release-candidate-tag }}
+          RELEASE_CANDIDATE_SHA: ${{ inputs.sha }}
+        run: |
+          test -n "${RELEASE_CANDIDATE_TAG}"
+          git tag --force "${RELEASE_CANDIDATE_TAG}" "${RELEASE_CANDIDATE_SHA}"
+          git remote set-url --push origin no_push
+          git show-ref --verify --quiet "refs/tags/${RELEASE_CANDIDATE_TAG}"
       - name: Standardize repository information
         env:
           RAPIDS_REPOSITORY: ${{ inputs.repo || github.repository }}
@@ -200,7 +219,7 @@ jobs:
           MAMBA_USE_SHARDED_REPODATA: false
           RATTLER_SHARDED: false
       - name: Get Package Name and Location
-        if: ${{ inputs.upload-artifacts }}
+        if: ${{ inputs.upload-artifacts || inputs.build_type == 'release-candidate' }}
         env:
           # Pass RAPIDS_PACKAGE_NAME from cpp-build step if available
           RAPIDS_PACKAGE_NAME: ${{ steps.cpp-build.outputs.rapids-package-name }}
@@ -214,20 +233,41 @@ jobs:
           echo "CONDA_OUTPUT_DIR=${RAPIDS_CONDA_BLD_OUTPUT_DIR}" >> "${GITHUB_OUTPUT}"
         id: package-name
       - name: Show files to be uploaded
-        if: ${{ inputs.upload-artifacts }}
+        if: ${{ inputs.upload-artifacts || inputs.build_type == 'release-candidate' }}
         env:
           CONDA_OUTPUT_DIR: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }}
         run: |
           echo "Contents of directory to be uploaded:"
           ls -R "${CONDA_OUTPUT_DIR}"
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: ${{ inputs.upload-artifacts }}
+        if: ${{ inputs.upload-artifacts && inputs.build_type != 'release-candidate' }}
         with:
           if-no-files-found: 'error'
           name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
           path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }}
+
+      - name: Configure release-candidate store credentials
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        with:
+          aws-region: us-east-2
+          role-duration-seconds: 43200 # 12h
+          role-to-assume: arn:aws:iam::279114543810:role/gha-oidc-rapids-release-candidates
+      - name: Create Conda release catalog companion
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        uses: rapidsai/shared-actions/release-catalog@2bd36f0db6c8c553a14e8886ea62ce7b908c6a2c # shared-actions PR 136 candidate-store head
+        with:
+          config: >-
+            {
+              "release_catalog_key": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }},
+              "artifact_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }}
+            }
+          source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
+          source-sha: ${{ env.RAPIDS_SHA }}
+          candidate-train-sha256: ${{ inputs.candidate-train-sha256 }}
+          upload-to-s3: 'true'
       - name: Upload additional artifacts
-        if: "!cancelled()"
+        if: ${{ !cancelled() && inputs.build_type != 'release-candidate' }}
         run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)"
       - name: Telemetry upload attributes
         uses: rapidsai/shared-actions/telemetry-dispatch-stash-job-artifacts@main
diff --git a/.github/workflows/conda-python-build.yaml b/.github/workflows/conda-python-build.yaml
index 1a2bb291..35c3d3ea 100644
--- a/.github/workflows/conda-python-build.yaml
+++ b/.github/workflows/conda-python-build.yaml
@@ -2,7 +2,7 @@ on:
   workflow_call:
     inputs:
       build_type:
-        description: "One of: [branch, nightly, pull-request]"
+        description: "One of: [branch, nightly, pull-request, release-candidate]"
         required: true
         type: string
       branch:
@@ -44,6 +44,14 @@ on:
         default: true
         required: false
         description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store"
+      candidate-train-sha256:
+        description: "Canonical SHA-256 of the release train; required for release-candidate builds."
+        type: string
+        default: ""
+      release-candidate-tag:
+        description: "Final source tag created locally for a release-candidate build; it is never pushed."
+        type: string
+        default: ""
       matrix_filter:
         description: |
           jq expression which modifies the matrix.
@@ -119,6 +127,7 @@ jobs:
       image: rapidsai/ci-conda:26.10-cuda${{ matrix.CUDA_VER }}-${{ matrix.LINUX_VER }}-py${{ matrix.PY_VER }}
       env:
         RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}
+        RAPIDS_RELEASE_CANDIDATE: ${{ inputs.build_type == 'release-candidate' }}
         RAPIDS_DATETIME_STRING: ${{ inputs.build-datetime }}
     steps:
       - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
@@ -132,6 +141,16 @@ jobs:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
           persist-credentials: true
+      - name: Create local release-candidate tag
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        env:
+          RELEASE_CANDIDATE_TAG: ${{ inputs.release-candidate-tag }}
+          RELEASE_CANDIDATE_SHA: ${{ inputs.sha }}
+        run: |
+          test -n "${RELEASE_CANDIDATE_TAG}"
+          git tag --force "${RELEASE_CANDIDATE_TAG}" "${RELEASE_CANDIDATE_SHA}"
+          git remote set-url --push origin no_push
+          git show-ref --verify --quiet "refs/tags/${RELEASE_CANDIDATE_TAG}"
       - name: Standardize repository information
         env:
           RAPIDS_REPOSITORY: ${{ inputs.repo || github.repository }}
@@ -205,7 +224,7 @@ jobs:
           MAMBA_USE_SHARDED_REPODATA: false
           RATTLER_SHARDED: false
       - name: Get Package Name and Location
-        if: ${{ inputs.upload-artifacts }}
+        if: ${{ inputs.upload-artifacts || inputs.build_type == 'release-candidate' }}
         env:
           # Pass RAPIDS_PACKAGE_NAME from python-build step if available
           RAPIDS_PACKAGE_NAME: ${{ steps.python-build.outputs.rapids-package-name }}
@@ -219,20 +238,41 @@ jobs:
           echo "CONDA_OUTPUT_DIR=${RAPIDS_CONDA_BLD_OUTPUT_DIR}" >> "${GITHUB_OUTPUT}"
         id: package-name
       - name: Show files to be uploaded
-        if: ${{ inputs.upload-artifacts }}
+        if: ${{ inputs.upload-artifacts || inputs.build_type == 'release-candidate' }}
         env:
           CONDA_OUTPUT_DIR: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }}
         run: |
           echo "Contents of directory to be uploaded:"
           ls -R "${CONDA_OUTPUT_DIR}"
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: ${{ inputs.upload-artifacts }}
+        if: ${{ inputs.upload-artifacts && inputs.build_type != 'release-candidate' }}
         with:
           if-no-files-found: 'error'
           name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
           path: ${{ steps.package-name.outputs.CONDA_OUTPUT_DIR }}
+
+      - name: Configure release-candidate store credentials
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        with:
+          aws-region: us-east-2
+          role-duration-seconds: 43200 # 12h
+          role-to-assume: arn:aws:iam::279114543810:role/gha-oidc-rapids-release-candidates
+      - name: Create Conda release catalog companion
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        uses: rapidsai/shared-actions/release-catalog@2bd36f0db6c8c553a14e8886ea62ce7b908c6a2c # shared-actions PR 136 candidate-store head
+        with:
+          config: >-
+            {
+              "release_catalog_key": ${{ toJSON(format('conda:{0}', github.event.repository.name)) }},
+              "artifact_directory": ${{ toJSON(steps.package-name.outputs.CONDA_OUTPUT_DIR) }}
+            }
+          source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
+          source-sha: ${{ env.RAPIDS_SHA }}
+          candidate-train-sha256: ${{ inputs.candidate-train-sha256 }}
+          upload-to-s3: 'true'
       - name: Upload additional artifacts
-        if: "!cancelled()"
+        if: ${{ !cancelled() && inputs.build_type != 'release-candidate' }}
         run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}"
       - name: Telemetry upload attributes
         uses: rapidsai/shared-actions/telemetry-dispatch-stash-job-artifacts@main
diff --git a/.github/workflows/conda-upload-packages.yaml b/.github/workflows/conda-upload-packages.yaml
index 72af0686..db22641e 100644
--- a/.github/workflows/conda-upload-packages.yaml
+++ b/.github/workflows/conda-upload-packages.yaml
@@ -2,7 +2,7 @@ on:
   workflow_call:
     inputs:
       build_type:
-        description: "One of: [branch, nightly, pull-request]"
+        description: "One of: [branch, nightly, pull-request, release-candidate]"
         required: true
         type: string
       branch:
@@ -71,6 +71,9 @@ permissions:
 
 jobs:
   upload:
+    # Candidate artifacts are staged privately by the build workflow. They must
+    # not enter either public Anaconda.org channel before rollover approval.
+    if: ${{ inputs.build_type != 'release-candidate' }}
     runs-on: linux-amd64-cpu4
     container:
       image: "python:3.14-slim"
diff --git a/.github/workflows/custom-job.yaml b/.github/workflows/custom-job.yaml
index 7bc2560e..92c6a880 100644
--- a/.github/workflows/custom-job.yaml
+++ b/.github/workflows/custom-job.yaml
@@ -2,7 +2,7 @@ on:
   workflow_call:
     inputs:
       build_type:
-        description: "One of: [branch, nightly, pull-request]"
+        description: "One of: [branch, nightly, pull-request, release-candidate]"
         required: true
         type: string
       branch:
@@ -105,6 +105,22 @@ on:
         default: false
         type: boolean
         required: false
+      release-catalog-config:
+        description: >-
+          Optional JSON configuration for the shared-actions release catalog action. In release-candidate mode,
+          it writes the declared files and evidence to the private candidate store. See
+          https://github.com/rapidsai/shared-actions/tree/main/release-catalog for configuration details.
+        default: ''
+        type: string
+        required: false
+      candidate-train-sha256:
+        description: "Canonical SHA-256 of the release train; required for release-candidate builds."
+        type: string
+        default: ""
+      release-candidate-tag:
+        description: "Final source tag created locally for a release-candidate build; it is never pushed."
+        type: string
+        default: ""
 
 defaults:
   run:
@@ -139,6 +155,7 @@ jobs:
       env:
         NVIDIA_VISIBLE_DEVICES: ${{ env.NVIDIA_VISIBLE_DEVICES }}
         RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}
+        RAPIDS_RELEASE_CANDIDATE: ${{ inputs.build_type == 'release-candidate' }}
         RAPIDS_DATETIME_STRING: ${{ inputs.build-datetime }}
     steps:
       - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
@@ -152,6 +169,16 @@ jobs:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
           persist-credentials: true
+      - name: Create local release-candidate tag
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        env:
+          RELEASE_CANDIDATE_TAG: ${{ inputs.release-candidate-tag }}
+          RELEASE_CANDIDATE_SHA: ${{ inputs.sha }}
+        run: |
+          test -n "${RELEASE_CANDIDATE_TAG}"
+          git tag --force "${RELEASE_CANDIDATE_TAG}" "${RELEASE_CANDIDATE_SHA}"
+          git remote set-url --push origin no_push
+          git show-ref --verify --quiet "refs/tags/${RELEASE_CANDIDATE_TAG}"
       - name: Telemetry setup
         uses: rapidsai/shared-actions/telemetry-dispatch-setup@main
         continue-on-error: true
@@ -223,13 +250,30 @@ jobs:
           MAMBA_USE_SHARDED_REPODATA: false
           RATTLER_SHARDED: false
       - name: Upload file to GitHub Artifact
+        if: ${{ inputs.build_type != 'release-candidate' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{ inputs.file_to_upload }}
           if-no-files-found: ignore
+      - name: Configure release-candidate store credentials
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        with:
+          aws-region: us-east-2
+          role-duration-seconds: 43200 # 12h
+          role-to-assume: arn:aws:iam::279114543810:role/gha-oidc-rapids-release-candidates
+      - name: Create release catalog companion
+        if: ${{ inputs.build_type == 'release-candidate' && inputs.release-catalog-config != '' }}
+        uses: rapidsai/shared-actions/release-catalog@2bd36f0db6c8c553a14e8886ea62ce7b908c6a2c # shared-actions PR 136 candidate-store head
+        with:
+          config: ${{ inputs.release-catalog-config }}
+          source-artifact-name: ${{ inputs.artifact-name }}
+          source-sha: ${{ env.RAPIDS_SHA }}
+          candidate-train-sha256: ${{ inputs.candidate-train-sha256 }}
+          upload-to-s3: 'true'
       - name: Upload additional artifacts
-        if: "!cancelled()"
+        if: ${{ !cancelled() && inputs.build_type != 'release-candidate' }}
         run: rapids-upload-artifacts-dir "custom-job-$(arch)"
       - name: Telemetry upload attributes
         uses: rapidsai/shared-actions/telemetry-dispatch-stash-job-artifacts@main
diff --git a/.github/workflows/wheels-build.yaml b/.github/workflows/wheels-build.yaml
index c4050159..d1f76747 100644
--- a/.github/workflows/wheels-build.yaml
+++ b/.github/workflows/wheels-build.yaml
@@ -26,7 +26,7 @@ on:
         description: "Git repo to check out, in '{org}/{repo}' form, e.g. 'rapidsai/cudf'"
         type: string
       build_type:
-        description: "One of: [branch, nightly, pull-request]"
+        description: "One of: [branch, nightly, pull-request, release-candidate]"
         required: true
         type: string
       script:
@@ -75,6 +75,14 @@ on:
         default: true
         required: false
         description: "One of [true, false], true if artifacts should be uploaded to GitHub's artifact store"
+      candidate-train-sha256:
+        description: "Canonical SHA-256 of the release train; required for release-candidate builds."
+        type: string
+        default: ""
+      release-candidate-tag:
+        description: "Final source tag created locally for a release-candidate build; it is never pushed."
+        type: string
+        default: ""
       extra-repo:
         required: false
         type: string
@@ -149,6 +157,7 @@ jobs:
       image: "rapidsai/ci-wheel:26.10-cuda${{ matrix.CUDA_VER }}-${{ matrix.LINUX_VER }}-py${{ matrix.PY_VER }}"
       env:
         RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}
+        RAPIDS_RELEASE_CANDIDATE: ${{ inputs.build_type == 'release-candidate' }}
         RAPIDS_DATETIME_STRING: ${{ inputs.build-datetime }}
     steps:
       - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
@@ -165,6 +174,16 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Create local release-candidate tag
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        env:
+          RELEASE_CANDIDATE_TAG: ${{ inputs.release-candidate-tag }}
+          RELEASE_CANDIDATE_SHA: ${{ inputs.sha }}
+        run: |
+          test -n "${RELEASE_CANDIDATE_TAG}"
+          git tag --force "${RELEASE_CANDIDATE_TAG}" "${RELEASE_CANDIDATE_SHA}"
+          git remote set-url --push origin no_push
+          git show-ref --verify --quiet "refs/tags/${RELEASE_CANDIDATE_TAG}"
       - name: Standardize repository information
         uses: rapidsai/shared-actions/rapids-github-info@main
         with:
@@ -251,7 +270,7 @@ jobs:
         shell: bash -leo pipefail {0}
 
       - name: Get package name
-        if: ${{ inputs.upload-artifacts }}
+        if: ${{ inputs.upload-artifacts || inputs.build_type == 'release-candidate' }}
         env:
           # Pass RAPIDS_PACKAGE_NAME from build-wheel step if available
           RAPIDS_PACKAGE_NAME: ${{ steps.build-wheel.outputs.rapids-package-name }}
@@ -284,7 +303,7 @@ jobs:
         id: package-name
 
       - name: Show files to be uploaded
-        if: ${{ inputs.upload-artifacts }}
+        if: ${{ inputs.upload-artifacts || inputs.build_type == 'release-candidate' }}
         env:
           WHEEL_OUTPUT_DIR: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }}
         run: |
@@ -292,14 +311,35 @@ jobs:
           ls -R "$WHEEL_OUTPUT_DIR"
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        if: ${{ inputs.upload-artifacts }}
+        if: ${{ inputs.upload-artifacts && inputs.build_type != 'release-candidate' }}
         with:
           if-no-files-found: 'error'
           name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
           path: ${{ steps.package-name.outputs.WHEEL_OUTPUT_DIR }}
 
+      - name: Configure release-candidate store credentials
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        with:
+          aws-region: us-east-2
+          role-duration-seconds: 43200 # 12h
+          role-to-assume: arn:aws:iam::279114543810:role/gha-oidc-rapids-release-candidates
+      - name: Create wheel release catalog companion
+        if: ${{ inputs.build_type == 'release-candidate' }}
+        uses: rapidsai/shared-actions/release-catalog@2bd36f0db6c8c553a14e8886ea62ce7b908c6a2c # shared-actions PR 136 candidate-store head
+        with:
+          config: >-
+            {
+              "release_catalog_key": ${{ toJSON(format('wheel:{0}', github.event.repository.name)) }},
+              "artifact_directory": ${{ toJSON(steps.package-name.outputs.WHEEL_OUTPUT_DIR) }}
+            }
+          source-artifact-name: ${{ steps.package-name.outputs.RAPIDS_PACKAGE_NAME }}
+          source-sha: ${{ env.RAPIDS_SHA }}
+          candidate-train-sha256: ${{ inputs.candidate-train-sha256 }}
+          upload-to-s3: 'true'
+
       - name: Upload additional artifacts
-        if: "!cancelled()"
+        if: ${{ !cancelled() && inputs.build_type != 'release-candidate' }}
         run: rapids-upload-artifacts-dir "cuda${RAPIDS_CUDA_VERSION%%.*}_$(arch)_py${RAPIDS_PY_VERSION//.}"
       - name: Telemetry upload attributes
         if: ${{ vars.TELEMETRY_ENABLED == 'true' }}
diff --git a/.github/workflows/wheels-publish.yaml b/.github/workflows/wheels-publish.yaml
index 7c282759..01bdc752 100644
--- a/.github/workflows/wheels-publish.yaml
+++ b/.github/workflows/wheels-publish.yaml
@@ -18,7 +18,7 @@ on:
         description: "Git repo to check out, in '{org}/{repo}' form, e.g. 'rapidsai/cudf'"
         type: string
       build_type:
-        description: "One of: [branch, nightly, pull-request]"
+        description: "One of: [branch, nightly, pull-request, release-candidate]"
         required: true
         type: string
 
@@ -73,6 +73,9 @@ permissions:
 jobs:
   wheel-publish:
     name: wheels publish
+    # Candidate artifacts are staged privately by the build workflow. They must
+    # not enter public Anaconda.org or PyPI channels before rollover approval.
+    if: ${{ inputs.build_type != 'release-candidate' }}
     # Use a self-hosted runner to ensure we have sufficient disk space. Using
     # cpu8 since we shouldn't need much CPU horsepower.
     runs-on: "linux-amd64-cpu8"
diff --git a/README.md b/README.md
index 9752c524..c17eb4c0 100644
--- a/README.md
+++ b/README.md
@@ -96,3 +96,22 @@ wheel-tests:
 ```
 
 Values passed through `secrets:` are redacted everywhere in the GitHub UI, including in logs, and in most cases are replaced with `***`.
+
+### Release catalog
+
+We add additional metadata files to our builds to help track what dependencies
+were present at build time (a Software Bill of Materials, SBoM), as well as
+keeping track of artifacts as we prepare for releases. The standard Conda and
+wheel builders do this automatically and upload an additional
+`release-catalog-<artifact-name>` GitHub Actions artifact for every package
+bundle.
+
+`custom-job.yaml` can be used to produce artifacts, but the generation of extra
+metadata files are opt-in, not automatic. Supplying a non-empty
+`release-catalog-config` causes the job to upload the additional
+release catalog companion; leaving it empty uploads only the original artifact.
+
+See the
+[`shared-actions` release catalog documentation](https://github.com/rapidsai/shared-actions/tree/main/release-catalog)
+for the companion layout, configuration schema, examples, and evidence
+semantics.