diff --git a/.github/workflows/build-portable-windows.yml b/.github/workflows/build-portable-windows.yml
index d867a96..8b00795 100644
--- a/.github/workflows/build-portable-windows.yml
+++ b/.github/workflows/build-portable-windows.yml
@@ -15,6 +15,13 @@ on:
         description: 'pgvector Extension Version'
         required: false
         default: '0.8.0'
+  # Called by release-please.yml after it creates a release (the normal release path).
+  workflow_call:
+    inputs:
+      tag_name:
+        description: 'Release tag to build from and attach the bundle to'
+        required: true
+        type: string
   release:
     types: [published]
   push:
@@ -35,10 +42,20 @@ jobs:
     runs-on: windows-latest
     permissions:
       contents: write
+    # One bundle build per release tag (or per ref for PR/branch builds) at a time.
+    concurrency:
+      group: windows-portable-${{ inputs.tag_name || github.event.release.tag_name || github.ref }}
+      cancel-in-progress: false
+    env:
+      # Tag to attach to: workflow_call / workflow_dispatch input, release event, or pushed tag; empty for PR builds.
+      RELEASE_TAG: ${{ inputs.tag_name || github.event.release.tag_name || (startsWith(github.ref, 'refs/tags/v') && github.ref_name) || '' }}
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          # Build exactly the released code when a tag is given.
+          ref: ${{ inputs.tag_name || github.event.release.tag_name || github.ref }}
 
       - name: Set up Python 3.12
         uses: actions/setup-python@v5
@@ -129,8 +146,23 @@ jobs:
           retention-days: 30
 
       - name: Attach Portable Bundle to GitHub Release
-        if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'release' || github.event.inputs.tag_name != ''
-        uses: softprops/action-gh-release@v2
-        with:
-          tag_name: ${{ github.event.release.tag_name || github.event.inputs.tag_name || '' }}
-          files: dist/contextcortex-windows-x64-portable.zip
+        if: env.RELEASE_TAG != ''
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # --clobber replaces an asset from an earlier run, so a re-run is safe.
+          gh release upload "$env:RELEASE_TAG" "dist/contextcortex-windows-x64-portable.zip" --clobber --repo "${{ github.repository }}"
+          if ($LASTEXITCODE -ne 0) { throw "Upload to release $env:RELEASE_TAG failed" }
+
+      - name: Verify the Release Asset
+        if: env.RELEASE_TAG != ''
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $local = (Get-Item "dist/contextcortex-windows-x64-portable.zip").Length
+          $asset = gh release view "$env:RELEASE_TAG" --repo "${{ github.repository }}" --json assets --jq '.assets[] | select(.name == "contextcortex-windows-x64-portable.zip") | .size'
+          if (-not $asset) { throw "Release $env:RELEASE_TAG has no contextcortex-windows-x64-portable.zip" }
+          if ([int64]$asset -ne $local) { throw "Release asset size $asset differs from the built zip ($local bytes)" }
+          Write-Host "Release $env:RELEASE_TAG has contextcortex-windows-x64-portable.zip ($asset bytes)." -ForegroundColor Green
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index cee121c..748ca93 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -8,11 +8,13 @@ on:
 permissions:
   contents: write
   pull-requests: write
-  actions: write
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    outputs:
+      releases_created: ${{ steps.release.outputs.releases_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       - uses: googleapis/release-please-action@v4
         id: release
@@ -20,12 +22,14 @@ jobs:
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 
-      - name: Trigger Windows Portable Bundle Build
-        if: ${{ steps.release.outputs.releases_created == 'true' }}
-        run: |
-          echo "Release created for tag: ${{ steps.release.outputs.tag_name }}"
-          gh workflow run build-portable-windows.yml \
-            --ref "${{ steps.release.outputs.tag_name }}" \
-            -f tag_name="${{ steps.release.outputs.tag_name }}"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
+  # Releases and tags created with GITHUB_TOKEN do not trigger other workflows
+  # (release: published / push: tags), so the Windows bundle is built and
+  # attached here, as a reusable workflow in the same run.
+  windows-portable-bundle:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.releases_created == 'true' }}
+    permissions:
+      contents: write
+    uses: ./.github/workflows/build-portable-windows.yml
+    with:
+      tag_name: ${{ needs.release-please.outputs.tag_name }}