diff --git a/.github/workflows/node-server-tests.yml b/.github/workflows/node-server-tests.yml
index 452ea7446f9..15be17eb40e 100644
--- a/.github/workflows/node-server-tests.yml
+++ b/.github/workflows/node-server-tests.yml
@@ -203,7 +203,7 @@ jobs:
         if: needs.changes.outputs.qualification == 'false'
       - run: pnpm build:orcad
         env:
-          ORCA_REUSE_PREPARED_WINDOWS_SECURITY: ${{ github.event_name == 'pull_request' && runner.os == 'Windows' && steps.dependencies.outcome == 'success' }}
+          ORCA_REUSE_PREPARED_WINDOWS_SECURITY: ${{ runner.os == 'Windows' && steps.dependencies.outcome == 'success' }}
       - wait: bun-orcad
       - run: pnpm test:node-server --artifact ${{ runner.os == 'Linux' && '--cross-runtime' || '' }}
         env:
diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 47fa4d90d94..c5036b64e2f 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -108,6 +108,8 @@ jobs:
         with:
           ref: ${{ github.event_name == 'schedule' && 'main' || inputs.ref }}
           fetch-depth: 0
+          # Version recovery needs complete history and tags, but not historical file contents.
+          filter: blob:none
           # Why: version math recovers unpublished tags; checkout's default
           # fetch-tags:false hides them, so a patch cut recreates vX.Y.Z and
           # `git push` overwrites the existing tag.
@@ -1578,6 +1580,8 @@ jobs:
           command: ${{ matrix.release_command }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # The release command prepares and verifies this host's Electron native modules first.
+          ORCA_REUSE_PREPARED_NATIVE_RUNTIME: '1'
           # Why: the NSIS uninstaller only exists inside electron-builder's
           # uninstaller pass, which deletes it right after embedding it. The sign
           # hook in config/scripts/windows-uninstaller-signing.cjs copies it out
diff --git a/config/scripts/assert-github-release-is-draft.test.mjs b/config/scripts/assert-github-release-is-draft.test.mjs
index aed313495de..e0ee7d7fc94 100644
--- a/config/scripts/assert-github-release-is-draft.test.mjs
+++ b/config/scripts/assert-github-release-is-draft.test.mjs
@@ -127,6 +127,8 @@ describe('release draft workflow contract', () => {
     )
 
     expect(electronBuilderConfig.publish.releaseType).toBe('draft')
+    expect(cutCheckout.with['fetch-depth']).toBe(0)
+    expect(cutCheckout.with.filter).toBe('blob:none')
     expect(cutCheckout.with['fetch-tags']).toBe(true)
     expect(linuxDraftStep.shell).toBe('bash')
     expect(linuxDraftStep.run).toContain('assert-github-release-is-draft.mjs')
diff --git a/config/scripts/orcad-windows-security.test.mjs b/config/scripts/orcad-windows-security.test.mjs
index 1b34c007095..7732a81a2f5 100644
--- a/config/scripts/orcad-windows-security.test.mjs
+++ b/config/scripts/orcad-windows-security.test.mjs
@@ -114,7 +114,7 @@ it('forwards the opt-in and pinned runtime only when compilation is needed', ()
 })
 
 it.each(['ssh-windows-hosts', 'node-server-tests'])(
-  'opts in only in prepared Windows PR packaging in %s',
+  'opts in only after Windows preparation, retaining the SSH PR boundary in %s',
   (name) => {
     const workflow = parse(readFileSync(`.github/workflows/${name}.yml`, 'utf8'))
     const job = workflow.jobs[name === 'ssh-windows-hosts' ? 'hosts' : 'persistence']
@@ -140,7 +140,7 @@ it.each(['ssh-windows-hosts', 'node-server-tests'])(
             }
           )
           expect(enabled).toBe(
-            event === 'pull_request' &&
+            (name === 'node-server-tests' || event === 'pull_request') &&
               outcome === 'success' &&
               (name === 'ssh-windows-hosts' || os === 'Windows')
           )
diff --git a/config/scripts/release-windows-signing-gate.test.mjs b/config/scripts/release-windows-signing-gate.test.mjs
index 3038e9e8cb5..0416e340a14 100644
--- a/config/scripts/release-windows-signing-gate.test.mjs
+++ b/config/scripts/release-windows-signing-gate.test.mjs
@@ -33,7 +33,12 @@ describe('Windows release signing waits for macOS success', () => {
     expect(jobs.build.needs).not.toContain('verify-mac-build')
     expect(jobs['build-mac'].needs).not.toContain('build')
     expect(jobs['verify-mac-build'].needs).toContain('build')
+    const windows = jobs.build.strategy.matrix.include.find((entry) => entry.platform === 'win')
+    expect(windows.release_command).toMatch(
+      /^node config\/scripts\/ensure-native-runtime\.mjs --runtime=electron; if \(\$LASTEXITCODE -ne 0\) \{ exit \$LASTEXITCODE \}; pnpm exec electron-builder /
+    )
     const packaging = steps.findIndex((step) => step.name === 'Build Windows release artifacts')
+    expect(steps[packaging].env.ORCA_REUSE_PREPARED_NATIVE_RUNTIME).toBe('1')
     const gateIndex = steps.indexOf(gate)
     expect(packaging).toBeGreaterThanOrEqual(0)
     expect(gateIndex).toBeGreaterThan(packaging)