diff --git a/.github/workflows/next_major.yml b/.github/workflows/next_major.yml
deleted file mode 100644
index 7270404858..0000000000
--- a/.github/workflows/next_major.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-name: Next Major Pull Request
-on:
-  push:
-    branches:
-      - 'changeset-release/next_major'
-
-jobs:
-  next_major_pr:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Don't Merge
-        run: |
-          echo "Don't merge the next_major, changeset pr into next_major. Instead when you're ready to release a new major version, change the base of this pr to main, and merge."
-          exit 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1a9df0570e..1ff88ae276 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,13 +1,21 @@
 name: Release
 on:
   push:
-    branches:
-      - 'main'
-      - 'next_major'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+  checks: write
+  statuses: write
+
 jobs:
-  release:
-    name: Final
-    if: ${{ github.repository == 'primer/css' }}
+  release-main:
+    name: Main
+    if: ${{ github.repository == 'primer/css' && github.ref_name == 'main' }}
 
     runs-on: ubuntu-latest
     steps:
@@ -19,9 +27,9 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
-          node-version: 18.x
+          node-version: 24
           cache: 'npm'
 
       - name: Install dependencies
@@ -45,4 +53,59 @@ jobs:
           publish: npm run release
         env:
           GITHUB_TOKEN: ${{ steps.get-access-token.outputs.access-token }}
-          NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN_SHARED }}
+
+  release-candidate:
+    name: Candidate
+    if: ${{ github.repository == 'primer/css' && github.ref_name == 'changeset-release/main' }}
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Publish release candidate
+        run: |
+          version=$(jq -r .version package.json)
+          echo "$( jq ".version = \"$(echo $version)-rc.$(git rev-parse --short HEAD)\"" package.json )" > package.json
+          npm publish --tag next
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Output candidate version number
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const package = require(`${process.env.GITHUB_WORKSPACE}/package.json`)
+            github.rest.repos.createCommitStatus({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              sha: context.sha,
+              state: 'success',
+              context: `Published ${package.name}`,
+              description: package.version,
+              target_url: `https://unpkg.com/${package.name}@${package.version}/`
+            })
+
+      - name: Upload versions json file
+        uses: primer/.github/.github/actions/upload-versions@main
+
+  release-canary:
+    name: Canary
+    if: ${{ github.repository == 'primer/css' && github.ref_name != 'main' && github.ref_name != 'changeset-release/main' }}
+    uses: primer/.github/.github/workflows/release_canary.yml@v2.3.0
+    with:
+      install: npm ci
+    secrets:
+      gh_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release_canary.yml b/.github/workflows/release_canary.yml
deleted file mode 100644
index 5ce410d245..0000000000
--- a/.github/workflows/release_canary.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-name: Release
-on:
-  push:
-    branches-ignore:
-      - 'main'
-      - 'changeset-release/**'
-    # Don't release canary when these paths change
-    # It's not necessary because we don't ship them and it creates noise
-    paths-ignore:
-      - '.changeset/**'
-      - 'docs/**'
-      - 'lib/**'
-      - '__tests__/**'
-      - 'script/**'
-      - 'next.config.js'
-      - 'now.json'
-
-jobs:
-  release-canary:
-    name: Canary
-    uses: primer/.github/.github/workflows/release_canary.yml@v2.2.0
-    with:
-      install: npm ci
-    secrets:
-      gh_token: ${{ secrets.GITHUB_TOKEN }}
-      npm_token: ${{ secrets.NPM_AUTH_TOKEN_SHARED }}
diff --git a/.github/workflows/release_candidate.yml b/.github/workflows/release_candidate.yml
deleted file mode 100644
index 671e889b09..0000000000
--- a/.github/workflows/release_candidate.yml
+++ /dev/null
@@ -1,58 +0,0 @@
-name: Release
-on:
-  push:
-    branches:
-      - 'changeset-release/**'
-
-jobs:
-  release-candidate:
-    name: Candidate
-    if: ${{ github.repository == 'primer/css' }}
-
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-        with:
-          # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
-          fetch-depth: 0
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v5
-        with:
-          node-version: 18.x
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Create .npmrc
-        run: |
-          cat << EOF > "$HOME/.npmrc"
-            //registry.npmjs.org/:_authToken=$NPM_TOKEN
-          EOF
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN_SHARED }}
-
-      - name: Publish release candidate
-        run: |
-          version=$(jq -r .version package.json)
-          echo "$( jq ".version = \"$(echo $version)-rc.$(git rev-parse --short HEAD)\"" package.json )" > package.json
-          npm publish --tag next
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Output candidate version number
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const package = require(`${process.env.GITHUB_WORKSPACE}/package.json`)
-            github.rest.repos.createCommitStatus({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              sha: context.sha,
-              state: 'success',
-              context: `Published ${package.name}`,
-              description: package.version,
-              target_url: `https://unpkg.com/${package.name}@${package.version}/`
-            })