diff --git a/.github/workflows/publish-desktop.yml b/.github/workflows/publish-desktop.yml
index 166fcbf55..f4bb1bb5b 100644
--- a/.github/workflows/publish-desktop.yml
+++ b/.github/workflows/publish-desktop.yml
@@ -13,6 +13,11 @@ on:
         description: Git tag to publish (e.g. v1.4.1)
         required: true
         type: string
+      dry_run:
+        description: Build all distributables but do not touch the GitHub release
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -44,22 +49,22 @@ jobs:
           # smoke: run the compiled-sidecar smoke test on legs whose target
           # matches the runner (the mac x64 leg cross-compiles on an arm64
           # runner, so its binary can't be executed natively there).
-          - os: macos-latest
+          - os: blacksmith-6vcpu-macos-latest
             arch: arm64
             platform: mac
             bun-target: bun-darwin-arm64
             smoke: true
-          - os: macos-latest
+          - os: blacksmith-6vcpu-macos-latest
             arch: x64
             platform: mac
             bun-target: bun-darwin-x64
             smoke: false
-          - os: ubuntu-latest
+          - os: blacksmith-4vcpu-ubuntu-2404
             arch: x64
             platform: linux
             bun-target: bun-linux-x64
             smoke: true
-          - os: windows-latest
+          - os: blacksmith-8vcpu-windows-2025
             arch: x64
             platform: win
             bun-target: bun-windows-x64
@@ -103,6 +108,11 @@ jobs:
         with:
           node-version: 24
 
+      # No package/electron caches here on purpose: on Blacksmith's NVMe
+      # runners a cold `bun install` (8-55s) is as fast as a cache
+      # restore + warm install, and bun.lock changes on every release
+      # (Version Packages), so each publish would pay the cache-save tail
+      # (~45s on the mac critical path) for nothing.
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
@@ -215,6 +225,9 @@ jobs:
 
   release:
     needs: build
+    # dry_run builds and uploads workflow artifacts but never touches the
+    # GitHub release — used to rehearse workflow changes against a real tag.
+    if: ${{ !inputs.dry_run }}
     runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: write
@@ -255,14 +268,15 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          while IFS= read -r file; do
-            echo "Uploading: $file"
-            gh release upload "$RELEASE_TAG" "$file" --repo "$GITHUB_REPOSITORY" --clobber
-          done < <(find artifacts -type f \
+          # Parallel uploads; xargs exits non-zero if any single upload fails,
+          # which keeps the promote step below from running on a partial set.
+          find artifacts -type f \
             \( -name "*.dmg" -o -name "*.zip" -o -name "*.exe" \
             -o -name "*.AppImage" -o -name "*.deb" -o -name "*.rpm" \
             -o -name "*.blockmap" \
-            -o -name "latest*.yml" \))
+            -o -name "latest*.yml" \) -print0 \
+            | xargs -0 -n1 -P8 -I{} sh -c \
+              'echo "Uploading: $1"; exec gh release upload "$RELEASE_TAG" "$1" --repo "$GITHUB_REPOSITORY" --clobber' _ {}
 
       # Flip draft → published only after every desktop asset is uploaded —
       # this is the atomic point where the new tag becomes "latest".