diff --git a/.github/workflows/publish.yml b/.github/workflows/main.yml
similarity index 73%
rename from .github/workflows/publish.yml
rename to .github/workflows/main.yml
index fcadad0..e66df59 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/main.yml
@@ -1,4 +1,4 @@
-name: Publish
+name: Main Branch
 
 on:
   # Runs on pushes targeting the default branch
@@ -14,7 +14,7 @@ permissions:
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
 concurrency:
-  group: "publish"
+  group: "main"
   cancel-in-progress: false
 
 jobs:
@@ -31,17 +31,18 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: 'zulu'
-          java-version: '21'
+          java-version: '17'
           check-latest: true
 
       - name: Gradle Wrapper Validation
         uses: gradle/actions/wrapper-validation@v3
 
+
       - name: Test on Ubuntu
         run: ./gradlew assemble check --no-build-cache --no-daemon --stacktrace
 
   # Deploy to Github Pages
-  deploy:
+  github-pages:
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
@@ -93,24 +94,52 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: 'zulu'
-          java-version: '21'
+          java-version: '17'
           check-latest: true
 
       - name: Gradle Wrapper Validation
         uses: gradle/actions/wrapper-validation@v3
 
+      - name: Retrieve Version from gradle.properties
+        run: echo "VERSION_NAME=$(cat gradle.properties | grep "^version=" | awk -F'=' '{print $2}')" >> $GITHUB_ENV
+
       - name: Publish Snapshot
         run: ./gradlew :invert-models:publish :invert-gradle-plugin:publish --no-configuration-cache --stacktrace
+        if: success() && endsWith(env.VERSION_NAME, '-SNAPSHOT')
         env:
           ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_NEXUS_USERNAME }}
           ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
 
+
+  publish-release:
+    needs:
+      - test-ubuntu
+    runs-on: ubuntu-latest
+    if: github.repository == 'square/invert' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    timeout-minutes: 25
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'zulu'
+          java-version: '17'
+          check-latest: true
+
+      - name: Gradle Wrapper Validation
+        uses: gradle/actions/wrapper-validation@v3
+
       - name: Retrieve Version from gradle.properties
         run: echo "VERSION_NAME=$(cat gradle.properties | grep "^version=" | awk -F'=' '{print $2}')" >> $GITHUB_ENV
 
       - name: Publish release (main only)
-        run: ./gradlew :invert-models:closeAndReleaseRepository :invert-gradle-plugin:closeAndReleaseRepository --no-configuration-cache --stacktrace
+        run: ./gradlew :invert-models:publishAndReleaseToMavenCentral :invert-gradle-plugin:publishAndReleaseToMavenCentral --no-configuration-cache --stacktrace
         if: success() && !endsWith(env.VERSION_NAME, '-SNAPSHOT')
         env:
           ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_NEXUS_USERNAME }}
           ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
+          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.ARTIFACT_SIGNING_PRIVATE_KEY }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ''
diff --git a/.github/workflows/checks.yml b/.github/workflows/pr-checks.yml
similarity index 91%
rename from .github/workflows/checks.yml
rename to .github/workflows/pr-checks.yml
index 16d5149..e71ae71 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -1,9 +1,7 @@
 name: Checks
 
 on:
-  # Runs on pushes targeting the default branch
-  push:
-    branches: ["main"]
+  # Runs on PRs targeting the default branch
   pull_request:
     branches: ["main"]
 
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 9db3a2e..dc48d91 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -11,7 +11,7 @@ javax-inject = "1"
 kotlin = "2.0.0"
 kotlinx-serialization = "1.6.3"
 ktor = "2.3.11"
-vanniktech-maven-publish = "0.28.0"
+vanniktech-maven-publish = "0.29.0"
 jetbrains-compose = "1.6.10"
 ksp = "1.9.23-1.0.20"
 truth = "1.4.2"