diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e2bfab8..899b4b0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -53,6 +53,33 @@ jobs:
             -Psigning.gnupg.keyName=${{ secrets.GPG_KEY_ID }} \
             -Psigning.gnupg.passphrase=${{ secrets.GPG_PASSPHRASE }}
 
+      - name: Publish to Maven Central (Central Portal staging)
+        if: ${{ env.OSSRH_USERNAME != '' && env.OSSRH_PASSWORD != '' }}
+        env:
+          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+        run: |
+          ./gradlew :lumen:publishAllPublicationsToSonatypeRepository \
+            -Psigning.gnupg.keyName=${{ secrets.GPG_KEY_ID }} \
+            -Psigning.gnupg.passphrase=${{ secrets.GPG_PASSPHRASE }}
+
+      - name: Transfer staged deployment to the Central Portal
+        if: ${{ env.OSSRH_USERNAME != '' && env.OSSRH_PASSWORD != '' }}
+        env:
+          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+        run: |
+          # maven-publish only PUTs files with no deployment context, so the upload sits in the
+          # OSSRH-compat staging area until this manual-transfer call moves it into the Central
+          # Portal proper. Must run from the same IP that did the upload — hence same job/runner.
+          # Namespace = the Maven group, io.github.aldefy. Defaults to user_managed (needs a
+          # manual "Publish" click at https://central.sonatype.com/publishing/deployments) rather
+          # than automatic, so a bad release can be dropped before it goes live.
+          TOKEN=$(printf '%s:%s' "$OSSRH_USERNAME" "$OSSRH_PASSWORD" | base64)
+          curl --fail-with-body -X POST \
+            -H "Authorization: Bearer ${TOKEN}" \
+            "https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/io.github.aldefy"
+
       - name: Verify publications
         run: |
           EXPECTED=7
diff --git a/lumen/build.gradle.kts b/lumen/build.gradle.kts
index 06867c3..38d239c 100644
--- a/lumen/build.gradle.kts
+++ b/lumen/build.gradle.kts
@@ -160,10 +160,17 @@ publishing {
     repositories {
         maven {
             name = "sonatype"
-            val releasesUrl = uri("https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/")
-            val snapshotsUrl = uri("https://s01.oss.sonatype.org/content/repositories/snapshots/")
-            url = if (libraryVersion.endsWith("SNAPSHOT")) snapshotsUrl else releasesUrl
-
+            // s01.oss.sonatype.org (OSSRH) shut down 2025-06-30. This targets its replacement,
+            // the Central Portal's OSSRH-compatibility staging API. Snapshots aren't supported
+            // by this endpoint; SNAPSHOT versions have nowhere to publish until/unless the
+            // Central Portal's own snapshot repository is wired up separately.
+            // https://central.sonatype.org/publish/publish-portal-ossrh-staging-api/
+            url = uri("https://ossrh-staging-api.central.sonatype.com/service/local/staging/deploy/maven2/")
+
+            // Credentials are a Central Portal "user token" (username/password pair generated
+            // at https://central.sonatype.com/account, under Generate User Token) — not your
+            // Sonatype account's own login. The property/env names are kept as ossrhUsername/
+            // ossrhPassword and OSSRH_USERNAME/OSSRH_PASSWORD for continuity with the old setup.
             credentials {
                 username = findProperty("ossrhUsername")?.toString()
                     ?: System.getenv("OSSRH_USERNAME")