diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 295f0262..319dbc1a 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -45,10 +45,57 @@ jobs:
         git config --global user.name "github-actions[bot]"
         git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-    - name: Create Maven release
+    - name: Prepare and perform release (validate on Maven Central)
       env:
         MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
         MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
         RELEASE_GPG_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
+        RELEASE_VERSION: ${{ inputs.releaseVersion }}
+        DEVELOPMENT_VERSION: ${{ inputs.developmentVersion }}
       run: |
-        mvn -B -P release release:prepare release:perform -DreleaseVersion=${{ inputs.releaseVersion }} -DdevelopmentVersion=${{ inputs.developmentVersion }} -Darguments="-DskipITs"
+        mvn -B -P release release:prepare release:perform \
+          -DreleaseVersion="$RELEASE_VERSION" \
+          -DdevelopmentVersion="$DEVELOPMENT_VERSION" \
+          -Darguments="-DskipITs -Dcentral.autoPublish=false -Dcentral.waitUntil=validated" \
+          | tee maven-output.log
+        DEPLOYMENT_ID=$(grep -oP 'Deployment \K[a-f0-9-]+' maven-output.log | head -1)
+        if [ -z "$DEPLOYMENT_ID" ]; then
+          echo "::error::Could not extract deployment ID from Maven output"
+          exit 1
+        fi
+        echo "DEPLOYMENT_ID=$DEPLOYMENT_ID" >> "$GITHUB_ENV"
+        echo "Deployment $DEPLOYMENT_ID validated successfully"
+
+    - name: Push release commits and tag
+      run: |
+        git push origin "$(git describe --tags --abbrev=0)"
+        git push
+
+    - name: Publish release on Maven Central
+      env:
+        MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+        MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+      run: |
+        AUTH_TOKEN=$(printf '%s' "$MAVEN_CENTRAL_USERNAME:$MAVEN_CENTRAL_PASSWORD" | base64)
+
+        curl -f --retry 3 -X POST \
+          "https://central.sonatype.com/api/v1/publisher/deployment/$DEPLOYMENT_ID" \
+          -H "Authorization: Bearer $AUTH_TOKEN"
+
+        echo "Waiting for publication to complete..."
+        for i in $(seq 1 120); do
+          sleep 10
+          STATE=$(curl -s -X POST \
+            "https://central.sonatype.com/api/v1/publisher/status?id=$DEPLOYMENT_ID" \
+            -H "Authorization: Bearer $AUTH_TOKEN" | jq -r '.deploymentState')
+          echo "Deployment state: $STATE"
+          if [ "$STATE" = "PUBLISHED" ]; then
+            echo "Release published successfully on Maven Central"
+            exit 0
+          elif [ "$STATE" = "FAILED" ]; then
+            echo "::error::Publication failed on Maven Central"
+            exit 1
+          fi
+        done
+        echo "::error::Timed out waiting for publication (20 minutes)"
+        exit 1
diff --git a/confluence/pom.xml b/confluence/pom.xml
index 594835cb..cec1a2b0 100644
--- a/confluence/pom.xml
+++ b/confluence/pom.xml
@@ -80,6 +80,18 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+
+            <!--
+                The confluence-project POM (parent of confluence-api) defines ctk-plugin with a
+                Gradle-specific version string containing '@' (e.g. 6.0.2@platform_6.0.4).
+                Maven Central rejects version strings containing '@', so we override it here
+                with the valid Maven version.
+            -->
+            <dependency>
+                <groupId>com.atlassian.platform</groupId>
+                <artifactId>ctk-plugin</artifactId>
+                <version>6.0.2</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/pom.xml b/pom.xml
index 9727a148..36d33e5f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -99,6 +99,9 @@
         <junit.version>6.0.2</junit.version>
         <mockito.version>5.21.0</mockito.version>
         <bytebuddy.version>1.18.5</bytebuddy.version>
+        <!-- central publishing properties -->
+        <central.autoPublish>true</central.autoPublish>
+        <central.waitUntil>published</central.waitUntil>
     </properties>
 
     <dependencyManagement>
@@ -273,6 +276,8 @@
                 <configuration>
                     <tagNameFormat>v@{project.version}</tagNameFormat>
                     <autoVersionSubmodules>true</autoVersionSubmodules>
+                    <pushChanges>false</pushChanges>
+                    <localCheckout>true</localCheckout>
                 </configuration>
             </plugin>
 
@@ -367,8 +372,8 @@
                         <extensions>true</extensions>
                         <configuration>
                             <publishingServerId>central</publishingServerId>
-                            <autoPublish>true</autoPublish>
-                            <waitUntil>published</waitUntil>
+                            <autoPublish>${central.autoPublish}</autoPublish>
+                            <waitUntil>${central.waitUntil}</waitUntil>
                         </configuration>
                     </plugin>