diff --git a/.claude/rules/ci.md b/.claude/rules/ci.md
index cbbfc418f2..9f6de3ffb8 100644
--- a/.claude/rules/ci.md
+++ b/.claude/rules/ci.md
@@ -17,7 +17,7 @@ paths:
 
 - main and `release/*` require `CI`, the last job of `ci.yml`, and `PR title` (`pr-title.yml`). Strict is off. Admins can bypass in pull_request mode.
 - `CI` fails when a job it needs failed or was cancelled. A skipped job passes.
-- `release/0.82` keeps its own workflow files and the old per-workflow checks.
+- `release/0.82` and `release/0.83` were cut before `ci.yml`: they keep their own workflow files and the old per-workflow checks (ruleset 23957966).
 - Tags never move (ruleset 25308039, no bypass). Only admins create `release/*` and the `v*`, `ios-v*`, `linux-v*`, `libs-*` and `plugin-*` tags.
 
 ## Reading a red check
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6c2024c48f..4482f37c6c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -268,7 +268,12 @@ jobs:
       - name: Verify the release
         run: |
           set -euo pipefail
-          gh release verify "$TAG"
+          # GitHub writes the release attestation a few seconds after the release publishes.
+          for attempt in 1 2 3 4 5 6; do
+            gh release verify "$TAG" && break
+            [ "$attempt" -lt 6 ] || exit 1
+            sleep 10
+          done
           for asset in dist/*; do
             gh release verify-asset "$TAG" "$asset"
           done