diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3f0e1e98a6..db7d4a9a75 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,6 +49,18 @@ concurrency:
   group: release-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: false
 
+env:
+  # npm accepts a publish immediately, but the registry's CDN can lag packument
+  # propagation by several minutes (observed 2.5-4+ minutes on 2026-08-21,
+  # which failed four consecutive canary runs mid-loop). Give release.sh's
+  # post-publish visibility poll a 5-minute budget per package instead of its
+  # 60-second default; a healthy publish still exits the poll on the first
+  # visible check. The publish jobs' timeout-minutes are sized for several
+  # laggard packages; if most of a batch lags the full budget, npm is having
+  # a real incident and the job failing is correct.
+  NPM_PUBLISH_VERIFY_ATTEMPTS: "30"
+  NPM_PUBLISH_VERIFY_DELAY_SECONDS: "10"
+
 jobs:
   verify_canary:
     if: github.event_name == 'push'
@@ -60,7 +72,7 @@ jobs:
     if: github.event_name == 'push'
     needs: verify_canary
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
     environment: npm-canary
     permissions:
       contents: write
@@ -236,7 +248,7 @@ jobs:
       (needs.smoke_nightly.result == 'success' ||
        (needs.smoke_nightly.result == 'skipped' && github.event_name == 'workflow_dispatch' && inputs.dry_run))
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
     environment: npm-canary
     # The workflow-level concurrency group is per event, so a forced dispatch
     # nightly could otherwise overlap the scheduled one and race it to the
@@ -502,7 +514,7 @@ jobs:
       (needs.verify_beta_candidate.result == 'success' ||
        (needs.verify_beta_candidate.result == 'skipped' && needs.select_beta.outputs.mode == 'promote'))
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
     environment: npm-beta
     # Serialize beta publishes so two dispatches cannot race to the same next
     # -beta.N version; release.sh additionally refuses to double-publish a
@@ -919,7 +931,7 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && !inputs.dry_run
     needs: [preflight_stable, verify_stable]
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
     environment: npm-stable
     permissions:
       contents: write