diff --git a/scripts/ci-run.sh b/scripts/ci-run.sh
index 4f68bb2..393174f 100755
--- a/scripts/ci-run.sh
+++ b/scripts/ci-run.sh
@@ -108,55 +108,55 @@ case "$JOB" in
       err "GITEA_TOKEN is not set"
     fi
 
-    # Build the release binary with version injection.
+    info "building release binary ${VERSION}..."
     LDFLAGS="-s -w \
       -X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION} \
       -X git.cloudinit.dev/coreci/orca/internal/cli.gitCommit=${GIT_COMMIT} \
       -X git.cloudinit.dev/coreci/orca/internal/cli.buildTime=${BUILD_TIME}"
     mkdir -p bin
-    go build -trimpath -ldflags="${LDFLAGS}" -o bin/orca ./cmd/orca
-    make changelog
+    go build -trimpath -ldflags="${LDFLAGS}" -o bin/orca ./cmd/orca 2>&1 || err "go build failed"
     tar -czf "${TARBALL}" -C bin orca
     sha256sum "${TARBALL}" > SHA256SUMS
-    ls -lh "${TARBALL}" SHA256SUMS
-    cat SHA256SUMS
+    info "built ${TARBALL}"
 
-    # Install tea CLI for Gitea release creation.
-    sh -c "$(curl -fsSL https://gitea.com/gitea/tea/releases/latest/download/install.sh)" 2>/dev/null || true
+    # Create or update the Gitea release directly via the API.
+    # The CIAgent ship workflow may have already created the release
+    # (title+body, no binary). Check if it exists first.
+    info "checking for existing release ${VERSION}..."
+    RELEASE_ID=$(curl -fsSL \
+      "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/tags/${VERSION}" \
+      -H "Authorization: token ${GITEA_TOKEN}" \
+      | python3 -c "import json,sys; r=json.load(sys.stdin); print(r.get('id',''))" 2>/dev/null || echo "")
 
-    # Create release with assets. If the release already exists (created
-    # by the CIAgent ship workflow with title+body but no binary), fall
-    # back to attaching assets via the Gitea API.
-    info "creating gitea release ${VERSION}..."
-    if tea releases create "${VERSION}" \
-      --repo coreci/orca \
-      --title "Orca ${VERSION}" \
-      --note-file CHANGELOG.md \
-      --asset "${TARBALL}" \
-      --asset SHA256SUMS 2>/dev/null; then
-      info "release created via tea"
-    else
-      info "release may already exist — attaching assets via Gitea API..."
-      RELEASE_ID=$(curl -fsSL \
-        "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/tags/${VERSION}" \
+    if [ -z "${RELEASE_ID}" ]; then
+      info "creating new release ${VERSION}..."
+      RELEASE_ID=$(curl -fsSL -X POST \
+        "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases" \
         -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Content-Type: application/json" \
+        -d "{\"tag_name\":\"${VERSION}\",\"name\":\"Orca ${VERSION}\",\"body\":\"Release ${VERSION} built by CoreCI\"}" \
         | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || echo "")
-      if [ -n "${RELEASE_ID}" ]; then
-        info "attaching assets to release ID ${RELEASE_ID}..."
-        curl -fsSL -X POST \
-          "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/${RELEASE_ID}/assets?name=${TARBALL}" \
-          -H "Authorization: token ${GITEA_TOKEN}" \
-          -F "attachment=@${TARBALL}"
-        curl -fsSL -X POST \
-          "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/${RELEASE_ID}/assets?name=SHA256SUMS" \
-          -H "Authorization: token ${GITEA_TOKEN}" \
-          -F "attachment=@SHA256SUMS"
-        info "assets attached via API"
-      else
-        err "could not resolve release ID for ${VERSION}"
+      if [ -z "${RELEASE_ID}" ]; then
+        err "failed to create release ${VERSION}"
       fi
+      info "created release ID ${RELEASE_ID}"
+    else
+      info "release ${VERSION} already exists (ID ${RELEASE_ID}) — attaching assets"
     fi
 
+    # Attach tarball and SHA256SUMS to the release.
+    info "attaching ${TARBALL} to release ${RELEASE_ID}..."
+    curl -fsSL -X POST \
+      "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/${RELEASE_ID}/assets?name=${TARBALL}" \
+      -H "Authorization: token ${GITEA_TOKEN}" \
+      -F "attachment=@${TARBALL}" 2>&1 || err "failed to attach ${TARBALL}"
+
+    info "attaching SHA256SUMS to release ${RELEASE_ID}..."
+    curl -fsSL -X POST \
+      "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/${RELEASE_ID}/assets?name=SHA256SUMS" \
+      -H "Authorization: token ${GITEA_TOKEN}" \
+      -F "attachment=@SHA256SUMS" 2>&1 || err "failed to attach SHA256SUMS"
+
     # Verify assets are actually attached (REQ-097, gate C-21).
     ASSET_COUNT=$(curl -fsSL \
       "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/tags/${VERSION}" \
@@ -164,29 +164,7 @@ case "$JOB" in
       | python3 -c "import json,sys; print(len(json.load(sys.stdin).get('attachments',[])))" 2>/dev/null || echo "0")
     info "release ${VERSION} has ${ASSET_COUNT} assets"
     if [ "${ASSET_COUNT}" -lt 2 ]; then
-      info "assets missing after tea — attempting manual attachment..."
-      RELEASE_ID=$(curl -fsSL \
-        "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/tags/${VERSION}" \
-        -H "Authorization: token ${GITEA_TOKEN}" \
-        | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || echo "")
-      if [ -n "${RELEASE_ID}" ]; then
-        curl -fsSL -X POST \
-          "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/${RELEASE_ID}/assets?name=${TARBALL}" \
-          -H "Authorization: token ${GITEA_TOKEN}" \
-          -F "attachment=@${TARBALL}"
-        curl -fsSL -X POST \
-          "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/${RELEASE_ID}/assets?name=SHA256SUMS" \
-          -H "Authorization: token ${GITEA_TOKEN}" \
-          -F "attachment=@SHA256SUMS"
-        ASSET_COUNT=$(curl -fsSL \
-          "https://git.cloudinit.dev/api/v1/repos/coreci/orca/releases/tags/${VERSION}" \
-          -H "Authorization: token ${GITEA_TOKEN}" \
-          | python3 -c "import json,sys; print(len(json.load(sys.stdin).get('attachments',[])))" 2>/dev/null || echo "0")
-        info "after retry: ${ASSET_COUNT} assets"
-      fi
-      if [ "${ASSET_COUNT}" -lt 2 ]; then
-        err "assets not attached after retry (REQ-097, C-21)"
-      fi
+      err "assets not attached after upload (REQ-097, C-21) — got ${ASSET_COUNT}"
     fi
     info "release ${VERSION} published with ${ASSET_COUNT} binary assets"
     ;;