diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 2e2ce3b..202bc9d 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -102,6 +102,8 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up environment
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
         run: make setup-image
       - name: Release dry-run validation
         env:
@@ -109,7 +111,7 @@ jobs:
         run: |
           . .venv/bin/activate
           export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.release --dry-run || true
+          python3 -m devx.ci.release --dry-run
 
   pr-review:
     if: github.event_name == 'pull_request'
@@ -138,12 +140,13 @@ jobs:
     # Auto-merge runs after all CI checks pass. It reads the task ID
     # from the branch name, validates the PR title, and squash-merges.
     # Uses always() so it runs even when detect-changes skips (no user-facing changes).
-    needs: [quality, detect-changes, pr-review]
+    needs: [quality, detect-changes, pr-review, release-dry-run]
     if: >-
       always() &&
       github.event_name == 'pull_request' &&
       needs.quality.result == 'success' &&
-      needs.pr-review.result == 'success'
+      needs.pr-review.result == 'success' &&
+      (needs.release-dry-run.result == 'success' || needs.release-dry-run.result == 'skipped')
     runs-on: docker
     container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 10