diff --git a/.github/workflows/pdfium-auto-release.yaml b/.github/workflows/pdfium-auto-release.yaml
index edbffe1..291145e 100644
--- a/.github/workflows/pdfium-auto-release.yaml
+++ b/.github/workflows/pdfium-auto-release.yaml
@@ -170,6 +170,16 @@ jobs:
           git tag "$tag"
           git push origin "$tag"
 
+      - name: Create GitHub release
+        # Tags pushed with GITHUB_TOKEN don't trigger other workflows (including
+        # release-graalvm.yaml), so the release must be created here explicitly.
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          tag="v${{ needs.detect.outputs.full_version }}"
+          gh release create "$tag" --title "$tag" --generate-notes
+
       - name: Delete bump branch
         run: git push origin --delete "${{ needs.detect.outputs.branch }}" || true
 
@@ -211,15 +221,18 @@ jobs:
         uses: gradle/actions/setup-gradle@v5
 
       - name: Publish to Maven Central
-        # GITHUB_REF override drives pdfium/build.gradle.kts publishVersion (reads
-        # GITHUB_REF and strips refs/tags/v). The tag was pushed by GITHUB_TOKEN
-        # so publish-maven.yaml will not fire — publishing inline avoids the
-        # recursive-trigger gap and keeps everything in one run.
+        # -PpublishVersion drives pdfium/build.gradle.kts publishVersion — the GITHUB_REF
+        # default variable cannot be overridden via `env:` (the runner re-applies it), which
+        # silently produced an invalid 'refs/heads/master' version and broke every inline
+        # publish. The tag was pushed by GITHUB_TOKEN so publish-maven.yaml will not fire —
+        # publishing inline avoids the recursive-trigger gap and keeps everything in one run.
         env:
-          GITHUB_REF: refs/tags/v${{ needs.detect.outputs.full_version }}
           ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVENCENTRALUSERNAME }}
           ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVENCENTRALPASSWORD }}
           ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNINGINMEMORYKEY }}
           ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.SIGNINGKEYID }}
           ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNINGPASSWORD }}
-        run: ./gradlew :pdfium:publishAndReleaseToMavenCentral --no-configuration-cache
+        run: >
+          ./gradlew :pdfium:publishAndReleaseToMavenCentral
+          -PpublishVersion=${{ needs.detect.outputs.full_version }}
+          --no-configuration-cache
diff --git a/README.md b/README.md
index ff5ccd4..2d09b1a 100644
--- a/README.md
+++ b/README.md
@@ -53,7 +53,7 @@ Published to Maven Central. Requires Gradle 8.10+ and Kotlin 2.3.20+. The
 kotlin {
     sourceSets {
         commonMain.dependencies {
-            implementation("dev.nucleusframework:pdfium:149.0.7802.0b")
+            implementation("dev.nucleusframework:pdfium:152.0.7934.0b")
         }
     }
 }
diff --git a/pdfium/build.gradle.kts b/pdfium/build.gradle.kts
index 8b26c0c..aef24bb 100644
--- a/pdfium/build.gradle.kts
+++ b/pdfium/build.gradle.kts
@@ -26,10 +26,16 @@ plugins {
     alias(libs.plugins.vanniktechMavenPublish)
 }
 
+// Explicit -PpublishVersion wins (used by the auto-release inline publish, where the
+// GITHUB_REF default variable cannot be overridden). Otherwise derive from a release
+// tag ref; non-tag refs (refs/heads/…) fall back to the dev version instead of
+// producing an invalid version containing '/'.
 val publishVersion: String =
-    providers.environmentVariable("GITHUB_REF")
-        .orNull
-        ?.removePrefix("refs/tags/v")
+    providers.gradleProperty("publishVersion").orNull
+        ?: providers.environmentVariable("GITHUB_REF")
+            .orNull
+            ?.takeIf { it.startsWith("refs/tags/v") }
+            ?.removePrefix("refs/tags/v")
         ?: "0.1.0"
 
 group = "dev.nucleusframework"