diff --git a/.forgejo/workflows/dev-release.yml b/.forgejo/workflows/dev-release.yml
index b311ac8..3751afa 100644
--- a/.forgejo/workflows/dev-release.yml
+++ b/.forgejo/workflows/dev-release.yml
@@ -1,5 +1,8 @@
 name: dev release
 
+# Publishes a dev-track build on every push to `main` (the trunk
+# branch — there is no separate `dev` branch). See bread-ecosystem's
+# docs/release-channels.md for the release-track policy this is part of.
 on:
   push:
     branches: ['main']
@@ -17,13 +20,15 @@ jobs:
 
       - name: build inside container
         run: |
-          docker run --rm \
+          podman run --rm \
             -v "$(pwd)/src:/workspace" \
             -w /workspace \
             fedora:41 \
             bash -c "
               set -euo pipefail
-              dnf install -y gcc pkgconf-pkg-config libadwaita-devel cargo
+              dnf install -y gcc pkgconf-pkg-config libadwaita-devel git curl
+              curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+              source \$HOME/.cargo/env
               cargo build --release --locked
             "
 
@@ -31,6 +36,11 @@ jobs:
         run: |
           set -euo pipefail
           cd src
+          # Base the dev version off the latest published stable tag,
+          # not Cargo.toml — Cargo.toml can go stale relative to the last
+          # real release (seen in practice: breadbox/breadpad/breadcrumbs/
+          # breadpaper), which would make a dev build sort as OLDER than
+          # what's already installed and bakery would correctly refuse it.
           LATEST_TAG="$(git ls-remote --tags --refs \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
             | awk -F/ '{print $NF}' | sed 's/^v//' | (grep -v -- '-' || true) | sort -V | tail -1)"
@@ -60,6 +70,8 @@ jobs:
           cp src/bakery.toml "${PKG_DIR}/bakery.toml"
           ln -sfn "${VERSION}" "/srv/breadway-dl/dev/breadpad/latest"
 
+      # No GitHub Release upload — dev, like the other non-stable track,
+      # is only distributed via dl.breadway.dev/dev/.
       - name: regenerate dev index.json
         env:
           MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
@@ -70,7 +82,9 @@ jobs:
             exit 1
           fi
           rm -rf /tmp/bread-ecosystem-ci-* 2>/dev/null || true
+          # mktemp: a fixed clone path races when multiple repos' dev/beta
+          # workflows run close together on the same self-hosted runner.
           ECOSYSTEM_CI_DIR="$(mktemp -d /tmp/bread-ecosystem-ci-XXXXXX)"
           git clone --branch main https://git.breadway.dev/Breadway/bread-ecosystem.git "${ECOSYSTEM_CI_DIR}"
           TRACK=dev bash "${ECOSYSTEM_CI_DIR}/scripts/gen-index.sh"
-          rm -rf "${ECOSYSTEM_CI_DIR}"
+          rm -rf "${ECOSYSTEM_CI_DIR}"
\ No newline at end of file
diff --git a/.forgejo/workflows/rc-release.yml b/.forgejo/workflows/rc-release.yml
index 5d8271a..295883e 100644
--- a/.forgejo/workflows/rc-release.yml
+++ b/.forgejo/workflows/rc-release.yml
@@ -1,5 +1,9 @@
 name: beta (rc) release
 
+# Publishes a beta-track build for any `vX.Y.Z-rc.N` prerelease tag
+# pushed to `main` — there is no separate `beta` branch; "freezing" is
+# just pausing pushes to main while an RC gets tested. See
+# bread-ecosystem's docs/release-channels.md for the release-track policy.
 on:
   push:
     tags: ['v*']
@@ -18,13 +22,15 @@ jobs:
 
       - name: build inside container
         run: |
-          docker run --rm \
+          podman run --rm \
             -v "$(pwd)/src:/workspace" \
             -w /workspace \
             fedora:41 \
             bash -c "
               set -euo pipefail
-              dnf install -y gcc pkgconf-pkg-config libadwaita-devel cargo
+              dnf install -y gcc pkgconf-pkg-config libadwaita-devel git curl
+              curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+              source \$HOME/.cargo/env
               cargo build --release --locked
             "
 
@@ -45,6 +51,8 @@ jobs:
           cp src/bakery.toml "${PKG_DIR}/bakery.toml"
           ln -sfn "${VERSION}" "/srv/breadway-dl/beta/breadpad/latest"
 
+      # No GitHub Release upload — beta, like dev, is only distributed via
+      # dl.breadway.dev/beta/.
       - name: regenerate beta index.json
         env:
           MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
@@ -55,7 +63,9 @@ jobs:
             exit 1
           fi
           rm -rf /tmp/bread-ecosystem-ci-* 2>/dev/null || true
+          # mktemp: a fixed clone path races when multiple repos' dev/beta
+          # workflows run close together on the same self-hosted runner.
           ECOSYSTEM_CI_DIR="$(mktemp -d /tmp/bread-ecosystem-ci-XXXXXX)"
           git clone https://git.breadway.dev/Breadway/bread-ecosystem.git "${ECOSYSTEM_CI_DIR}"
           TRACK=beta bash "${ECOSYSTEM_CI_DIR}/scripts/gen-index.sh"
-          rm -rf "${ECOSYSTEM_CI_DIR}"
+          rm -rf "${ECOSYSTEM_CI_DIR}"
\ No newline at end of file
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index eba2145..b31801d 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -18,13 +18,15 @@ jobs:
 
       - name: build inside container
         run: |
-          docker run --rm \
+          podman run --rm \
             -v "$(pwd)/src:/workspace" \
             -w /workspace \
             fedora:41 \
             bash -c "
               set -euo pipefail
-              dnf install -y gcc pkgconf-pkg-config libadwaita-devel cargo
+              dnf install -y gcc pkgconf-pkg-config libadwaita-devel git curl
+              curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+              source \$HOME/.cargo/env
               cargo build --release --locked
             "
 
@@ -66,4 +68,4 @@ jobs:
             "${PKG_DIR}/breadman-x86_64" \
             "${PKG_DIR}/breadpad-x86_64.sha256" \
             "${PKG_DIR}/breadman-x86_64.sha256" \
-            --clobber
+            --clobber
\ No newline at end of file