diff --git a/.forgejo/workflows/dev-bakery.yml b/.forgejo/workflows/dev-bakery.yml
index ae2e9ef..f63769e 100644
--- a/.forgejo/workflows/dev-bakery.yml
+++ b/.forgejo/workflows/dev-bakery.yml
@@ -1,11 +1,11 @@
 name: dev bakery
 
-# Publishes a dev-track build on every push to `dev` — separate from
-# release-bakery.yml's tag-triggered stable releases. See docs/release-channels.md
-# for the three-track policy (stable/beta/dev) this is part of.
+# Publishes a dev-track build on every push to `main` (the trunk branch —
+# there is no separate `dev` branch). See docs/release-channels.md for the
+# release-track policy this is part of.
 on:
   push:
-    branches: ['dev']
+    branches: ['main']
     paths:
       - 'bakery/**'
       - 'Cargo.toml'
@@ -20,7 +20,7 @@ jobs:
         run: |
           set -euo pipefail
           rm -rf src && mkdir src
-          git clone --branch dev --depth 1 \
+          git clone --branch main --depth 1 \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
@@ -45,7 +45,7 @@ jobs:
           # what's already installed and bakery would correctly refuse it.
           LATEST_TAG="$(git ls-remote --tags --refs \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
-            | awk -F/ '{print $NF}' | sed 's/^v//' | sort -V | tail -1)"
+            | awk -F/ '{print $NF}' | sed 's/^v//' | (grep -v -- '-' || true) | sort -V | tail -1)"
           if [ -n "${LATEST_TAG}" ]; then
             CUR="${LATEST_TAG}"
           else
diff --git a/.forgejo/workflows/dev-bread-theme.yml b/.forgejo/workflows/dev-bread-theme.yml
index 3d645d2..1cff78e 100644
--- a/.forgejo/workflows/dev-bread-theme.yml
+++ b/.forgejo/workflows/dev-bread-theme.yml
@@ -1,11 +1,11 @@
 name: dev bread-theme
 
-# Publishes a dev-track build on every push to `dev` — separate from
-# release-bread-theme.yml's tag-triggered stable releases. See
-# docs/release-channels.md for the three-track policy this is part of.
+# Publishes a dev-track build on every push to `main` (the trunk branch —
+# there is no separate `dev` branch). See docs/release-channels.md for the
+# release-track policy this is part of.
 on:
   push:
-    branches: ['dev']
+    branches: ['main']
     paths:
       - 'bread-theme/**'
       - 'Cargo.toml'
@@ -20,7 +20,7 @@ jobs:
         run: |
           set -euo pipefail
           rm -rf src && mkdir src
-          git clone --branch dev --depth 1 \
+          git clone --branch main --depth 1 \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
@@ -37,7 +37,7 @@ jobs:
           # what's already installed and bakery would correctly refuse it.
           LATEST_TAG="$(git ls-remote --tags --refs \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
-            | awk -F/ '{print $NF}' | sed 's/^v//' | sort -V | tail -1)"
+            | awk -F/ '{print $NF}' | sed 's/^v//' | (grep -v -- '-' || true) | sort -V | tail -1)"
           if [ -n "${LATEST_TAG}" ]; then
             CUR="${LATEST_TAG}"
           else
diff --git a/.forgejo/workflows/beta-bakery.yml b/.forgejo/workflows/rc-bakery.yml
similarity index 58%
rename from .forgejo/workflows/beta-bakery.yml
rename to .forgejo/workflows/rc-bakery.yml
index c20c069..dc7f695 100644
--- a/.forgejo/workflows/beta-bakery.yml
+++ b/.forgejo/workflows/rc-bakery.yml
@@ -1,12 +1,12 @@
-name: beta bakery
+name: beta (rc) bakery
 
-# Publishes a beta-track build on every push to `beta` — a frozen
-# stabilization branch cut from `dev` when ready to stabilize; only
-# fix/<issue> branches merged into `beta` should land here afterward.
-# See docs/release-channels.md for the three-track policy (stable/beta/dev).
+# Publishes a beta-track build for any `vX.Y.Z-rc.N` prerelease tag pushed
+# to `main` — there is no separate `beta` branch; "freezing" is just
+# pausing pushes to main while an RC gets tested. See
+# docs/release-channels.md for the release-track policy.
 on:
   push:
-    branches: ['beta']
+    tags: ['v*']
     paths:
       - 'bakery/**'
       - 'Cargo.toml'
@@ -15,13 +15,14 @@ on:
 
 jobs:
   build:
+    if: ${{ contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     steps:
       - name: checkout
         run: |
           set -euo pipefail
           rm -rf src && mkdir src
-          git clone --branch beta --depth 1 \
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
@@ -30,36 +31,10 @@ jobs:
       - name: test
         run: cd src && cargo test --release --locked -p bakery
 
-      # Auto-bumps the patch version from the latest tag and appends a
-      # timestamp+sha beta suffix — no developer discipline required, and the
-      # result is visibly "ahead of" the last stable patch release while
-      # staying valid semver (comparable within the beta track by bakery's
-      # `is_newer`).
-      - name: compute beta version
-        run: |
-          set -euo pipefail
-          cd src
-          # Base the beta version off the latest published stable tag,
-          # not Cargo.toml — Cargo.toml can go stale relative to the last
-          # real release (seen in practice: breadbox/breadpad/breadcrumbs/
-          # breadpaper), which would make a beta build sort as OLDER than
-          # what's already installed and bakery would correctly refuse it.
-          LATEST_TAG="$(git ls-remote --tags --refs \
-            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
-            | awk -F/ '{print $NF}' | sed 's/^v//' | sort -V | tail -1)"
-          if [ -n "${LATEST_TAG}" ]; then
-            CUR="${LATEST_TAG}"
-          else
-            CUR="$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
-          fi
-          IFS='.' read -r MA MI PA <<< "${CUR}"
-          SHA="$(git rev-parse --short HEAD)"
-          TS="$(date -u +%Y%m%d%H%M%S)"
-          echo "VERSION=${MA}.${MI}.$((PA + 1))-beta.${TS}+${SHA}" >> "$GITHUB_ENV"
-
       - name: prepare artifacts
         run: |
           set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
           PKG_DIR="/srv/breadway-dl/beta/bakery/${VERSION}"
           mkdir -p "${PKG_DIR}"
           cp "src/target/release/bakery" "${PKG_DIR}/bakery-x86_64"
diff --git a/.forgejo/workflows/beta-bread-theme.yml b/.forgejo/workflows/rc-bread-theme.yml
similarity index 60%
rename from .forgejo/workflows/beta-bread-theme.yml
rename to .forgejo/workflows/rc-bread-theme.yml
index c1521b9..c364ce6 100644
--- a/.forgejo/workflows/beta-bread-theme.yml
+++ b/.forgejo/workflows/rc-bread-theme.yml
@@ -1,12 +1,12 @@
-name: beta bread-theme
+name: beta (rc) bread-theme
 
-# Publishes a beta-track build on every push to `beta` — a frozen
-# stabilization branch cut from `dev` when ready to stabilize; only
-# fix/<issue> branches merged into `beta` should land here afterward.
-# See docs/release-channels.md for the three-track policy this is part of.
+# Publishes a beta-track build for any `vX.Y.Z-rc.N` prerelease tag pushed
+# to `main` — there is no separate `beta` branch; "freezing" is just
+# pausing pushes to main while an RC gets tested. See
+# docs/release-channels.md for the release-track policy.
 on:
   push:
-    branches: ['beta']
+    tags: ['v*']
     paths:
       - 'bread-theme/**'
       - 'Cargo.toml'
@@ -15,43 +15,23 @@ on:
 
 jobs:
   build:
+    if: ${{ contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     steps:
       - name: checkout
         run: |
           set -euo pipefail
           rm -rf src && mkdir src
-          git clone --branch beta --depth 1 \
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
         run: cd src && cargo build --release --locked -p bread-theme --bin bread-theme
 
-      - name: compute beta version
-        run: |
-          set -euo pipefail
-          cd src
-          # Base the beta version off the latest published stable tag,
-          # not Cargo.toml — Cargo.toml can go stale relative to the last
-          # real release (seen in practice: breadbox/breadpad/breadcrumbs/
-          # breadpaper), which would make a beta build sort as OLDER than
-          # what's already installed and bakery would correctly refuse it.
-          LATEST_TAG="$(git ls-remote --tags --refs \
-            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
-            | awk -F/ '{print $NF}' | sed 's/^v//' | sort -V | tail -1)"
-          if [ -n "${LATEST_TAG}" ]; then
-            CUR="${LATEST_TAG}"
-          else
-            CUR="$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
-          fi
-          IFS='.' read -r MA MI PA <<< "${CUR}"
-          SHA="$(git rev-parse --short HEAD)"
-          TS="$(date -u +%Y%m%d%H%M%S)"
-          echo "VERSION=${MA}.${MI}.$((PA + 1))-beta.${TS}+${SHA}" >> "$GITHUB_ENV"
-
       - name: prepare artifacts
         run: |
           set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
           PKG_DIR="/srv/breadway-dl/beta/bread-theme/${VERSION}"
           mkdir -p "${PKG_DIR}"
           cp "src/target/release/bread-theme" "${PKG_DIR}/bread-theme-x86_64"
diff --git a/.forgejo/workflows/release-bakery.yml b/.forgejo/workflows/release-bakery.yml
index 283153b..a2373cb 100644
--- a/.forgejo/workflows/release-bakery.yml
+++ b/.forgejo/workflows/release-bakery.yml
@@ -6,6 +6,7 @@ on:
 
 jobs:
   build:
+    if: ${{ !contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     steps:
       - name: checkout
diff --git a/.forgejo/workflows/release-bread-theme.yml b/.forgejo/workflows/release-bread-theme.yml
index 335f982..a8eb8df 100644
--- a/.forgejo/workflows/release-bread-theme.yml
+++ b/.forgejo/workflows/release-bread-theme.yml
@@ -6,6 +6,7 @@ on:
 
 jobs:
   build:
+    if: ${{ !contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     steps:
       - name: checkout