diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a1ca387..6eefc1a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -519,7 +519,6 @@ jobs:
           RELEASE_COMMIT: ${{ needs.preflight.outputs.commit }}
         run: |
           set -euo pipefail
-          test "$(gh api "repos/$GITHUB_REPOSITORY/immutable-releases" --jq .enabled)" = true
           policy=(
             --repo "$GITHUB_REPOSITORY"
             --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/release.yml"
@@ -544,6 +543,9 @@ jobs:
           release=$(gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --json isDraft,isPrerelease)
           test "$(jq -r .isDraft <<<"$release")" = false
           test "$(jq -r .isPrerelease <<<"$release")" = "$expected_prerelease"
+          # Repository settings require admin access; verify the published release instead.
+          test "$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" --jq .immutable)" = true
+          gh release verify "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null
           for asset in dist/*; do
             gh release verify-asset "$RELEASE_TAG" "$asset" --repo "$GITHUB_REPOSITORY" >/dev/null
           done