diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1c3db56..00fdc9a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -72,8 +72,13 @@ jobs:
             dist/*.zip
             dist/SHA256SUMS.txt
 
-      - name: Create or update GitHub release
+      - name: Create draft and publish immutable GitHub release
         run: |
           gh release view "$RELEASE_REF" >/dev/null 2>&1 || \
-            gh release create "$RELEASE_REF" --verify-tag --generate-notes
+            gh release create "$RELEASE_REF" --verify-tag --generate-notes --draft
+          test "$(gh release view "$RELEASE_REF" --json isDraft --jq .isDraft)" = "true" || {
+            echo "::error::Release $RELEASE_REF is already published and immutable."
+            exit 1
+          }
           gh release upload "$RELEASE_REF" dist/* --clobber
+          gh release edit "$RELEASE_REF" --draft=false