diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index ff990c4..3a2432d 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -16,7 +16,7 @@
 
 1. **Test** — the whole of `test.yml`
 2. **Release** (ubuntu) — `pkg-github-release`, `pkg-github-linux`, then
-   `dart pub publish --force --skip-validation`
+   `dart pub publish --force`
 3. **Deploy macOS** — `pkg-github-macos`, then the Homebrew formula, versioned
    and unversioned
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0a694c6..e6f9049 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -80,14 +80,12 @@ jobs:
       # OIDC token for temporary pub.dev credentials, so publish directly and
       # keep no durable secret.
       #
-      # The `test` job that gates this one already ran `dart pub publish
-      # --dry-run` at this commit, so --skip-validation drops only a repeated
-      # client-side pass; resolving again here would authenticate the reads
-      # that pub.dev rejects. pub.dev still validates the archive server-side.
-      # Drop the flag once https://github.com/dart-lang/pub-dev/issues/9576
-      # is fixed.
+      # --force skips the interactive confirmation, which a workflow cannot
+      # answer. Validation runs: dart-lang/pub-dev#9576, which rejected
+      # authenticated metadata reads with HTTP 403 and forced
+      # --skip-validation here, is fixed upstream.
       - name: Deploy to Pub
-        run: dart pub publish --force --skip-validation
+        run: dart pub publish --force
 
   deploy-macos:
     name: Deploy macOS