diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 72ffa93..e091242 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,6 +35,7 @@ jobs:
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
         run: |
           gh release create "$GITHUB_REF_NAME" dist/* \
             --verify-tag \
diff --git a/scripts/validate_release_workflows.py b/scripts/validate_release_workflows.py
index 06a5909..c48b99a 100644
--- a/scripts/validate_release_workflows.py
+++ b/scripts/validate_release_workflows.py
@@ -42,6 +42,9 @@ def validate(rehearsal_path: Path, release_path: Path) -> None:
     ), "only the publication job may request contents: write"
     assert release.count("contents: write") == 1
     assert release.count("gh release create") == 1
+    assert "GH_REPO: ${{ github.repository }}" in release, (
+        "checkout-free publication must provide explicit GitHub repository context"
+    )
 
 
 def main() -> None: