diff --git a/.github/workflows/release-snap.yml b/.github/workflows/release-snap.yml
index 9c48d3690..9323a4c58 100644
--- a/.github/workflows/release-snap.yml
+++ b/.github/workflows/release-snap.yml
@@ -39,6 +39,12 @@ concurrency:
   group: release-snap-${{ github.ref }}
   cancel-in-progress: false
 
+env:
+  # snapcore/action-{build,publish}@v1 still declares node20. Hosted runners
+  # already execute them successfully on Node 24; make that migration explicit
+  # before the Node 20 runtime is removed on 2026-09-16.
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   version:
     runs-on: ubuntu-24.04
@@ -52,6 +58,9 @@ jobs:
 
       - name: Resolve and validate package version
         id: release
+        env:
+          DISPATCH_TAG: ${{ inputs.tag }}
+          DISPATCH_PUBLISH: ${{ inputs.publish }}
         run: |
           set -euo pipefail
           if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
@@ -71,14 +80,32 @@ jobs:
             echo "::error::crates/Cargo.toml workspace version ($CARGO_VERSION) != requested version ($VERSION)."
             exit 1
           fi
+          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch && "$DISPATCH_PUBLISH" == true && -z "$DISPATCH_TAG" ]]; then
+            echo "::error::Manual publishing requires an explicit release tag"
+            exit 1
+          fi
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Verify tag is on main
-        if: startsWith(github.ref, 'refs/tags/')
+        if: startsWith(github.ref, 'refs/tags/') || inputs.publish
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
         run: |
-          git fetch origin main
-          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
-            echo "::error::Tag ${GITHUB_REF#refs/tags/} is not on main. Releases are cut from main only."
+          set -euo pipefail
+          tag="v${VERSION}"
+          git fetch origin main --tags
+          if ! git show-ref --verify --quiet "refs/tags/${tag}"; then
+            echo "::error::Release tag ${tag} does not exist."
+            exit 1
+          fi
+          tag_sha="$(git rev-parse "refs/tags/${tag}^{commit}")"
+          checkout_sha="$(git rev-parse HEAD)"
+          if [[ "$tag_sha" != "$checkout_sha" ]]; then
+            echo "::error::Checked-out commit does not match ${tag}."
+            exit 1
+          fi
+          if ! git merge-base --is-ancestor "$tag_sha" origin/main; then
+            echo "::error::Tag ${tag} is not on main. Releases are cut from main only."
             exit 1
           fi
 
diff --git a/packaging/snap-qt/snapcraft-arm64.yaml b/packaging/snap-qt/snapcraft-arm64.yaml
index aac8b33b9..0af729eb8 100644
--- a/packaging/snap-qt/snapcraft-arm64.yaml
+++ b/packaging/snap-qt/snapcraft-arm64.yaml
@@ -94,43 +94,17 @@ parts:
       qml: opt/qbz/qml
       qbz.desktop: usr/share/applications/qbz.desktop
       qbz.png: usr/share/icons/hicolor/256x256/apps/qbz.png
-    # Runtime the AppDir does NOT carry (linuxdeploy's blacklist).
+    # Runtime the AppDir does NOT carry. The AppDir contains Qt/QML, D-Bus and
+    # the non-system xcb/Wayland helpers selected by linuxdeploy; the GNOME
+    # extension supplies the host graphics, display and font stack. Keep this
+    # list to the audio helpers QBZ opens by name.
     stage-packages:
       # Audio (the bit-perfect path)
       - libasound2t64
       - libasound2-plugins
-      - libpipewire-0.3-0
       # Keep the runtime tools used by PipeWireBackend in both architectures.
       # They expose host sinks (including Bluetooth) and permit explicit sink
       # routing inside the connected strict Snap sandbox (#703).
       - pipewire-bin
       - pulseaudio-utils
       - libjack-jackd2-0
-      # TLS / HTTP
-      - libssl3t64
-      # Qt's xcb + wayland platform plugins
-      - libxkbcommon0
-      - libxkbcommon-x11-0
-      - libxcb1
-      - libxcb-cursor0
-      - libxcb-icccm4
-      - libxcb-image0
-      - libxcb-keysyms1
-      - libxcb-render-util0
-      - libxcb-shape0
-      - libxcb-xkb1
-      - libxcb-randr0
-      - libxcb-sync1
-      - libxcb-xfixes0
-      - libxcb-glx0
-      - libx11-6
-      - libwayland-client0
-      - libwayland-cursor0
-      - libwayland-egl1
-      - libegl1
-      - libgl1
-      # Fonts
-      - libfontconfig1
-      - libfreetype6
-      # Tray + portals + media controls over D-Bus
-      - libdbus-1-3
diff --git a/packaging/snap-qt/snapcraft.yaml b/packaging/snap-qt/snapcraft.yaml
index 7a2c35631..2904e6d3f 100644
--- a/packaging/snap-qt/snapcraft.yaml
+++ b/packaging/snap-qt/snapcraft.yaml
@@ -94,12 +94,14 @@ parts:
       qml: opt/qbz/qml
       qbz.desktop: usr/share/applications/qbz.desktop
       qbz.png: usr/share/icons/hicolor/256x256/apps/qbz.png
-    # Runtime the AppDir does NOT carry (linuxdeploy's blacklist).
+    # Runtime the AppDir does NOT carry. The AppDir contains Qt/QML, D-Bus and
+    # the non-system xcb/Wayland helpers selected by linuxdeploy; the GNOME
+    # extension supplies the host graphics, display and font stack. Keep this
+    # list to the audio helpers QBZ opens by name.
     stage-packages:
       # Audio (the bit-perfect path)
       - libasound2t64
       - libasound2-plugins
-      - libpipewire-0.3-0
       # The backend invokes these at runtime: pw-dump discovers the host sinks
       # (including Bluetooth) and pw-metadata/pactl select and inspect them.
       # Without the binaries the strict Snap sees only the generic CPAL bridge
@@ -107,31 +109,3 @@ parts:
       - pipewire-bin
       - pulseaudio-utils
       - libjack-jackd2-0
-      # TLS / HTTP
-      - libssl3t64
-      # Qt's xcb + wayland platform plugins
-      - libxkbcommon0
-      - libxkbcommon-x11-0
-      - libxcb1
-      - libxcb-cursor0
-      - libxcb-icccm4
-      - libxcb-image0
-      - libxcb-keysyms1
-      - libxcb-render-util0
-      - libxcb-shape0
-      - libxcb-xkb1
-      - libxcb-randr0
-      - libxcb-sync1
-      - libxcb-xfixes0
-      - libxcb-glx0
-      - libx11-6
-      - libwayland-client0
-      - libwayland-cursor0
-      - libwayland-egl1
-      - libegl1
-      - libgl1
-      # Fonts
-      - libfontconfig1
-      - libfreetype6
-      # Tray + portals + media controls over D-Bus
-      - libdbus-1-3