diff --git a/.github/workflows/java-publish-maven.yml b/.github/workflows/java-publish-maven.yml
index 03c9136ab..50e563a9d 100644
--- a/.github/workflows/java-publish-maven.yml
+++ b/.github/workflows/java-publish-maven.yml
@@ -32,8 +32,42 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  preflight:
+    name: Preflight checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify JAVA_RELEASE_TOKEN can push to repository
+        run: |
+          # JAVA_RELEASE_TOKEN is used by actions/checkout and for:
+          #   - git push origin main (doc updates)
+          #   - mvn release:prepare -DpushChanges=true (release commits + tags)
+          #   - git revert + push (rollback on failure)
+          # It must have push (contents:write) permission on this repo.
+          PUSH=$(gh api repos/${{ github.repository }} --jq '.permissions.push // false')
+          if [ "$PUSH" != "true" ]; then
+            echo "::error::JAVA_RELEASE_TOKEN lacks push permission on ${{ github.repository }}. It is required for pushing release commits and tags to main."
+            exit 1
+          fi
+          echo "JAVA_RELEASE_TOKEN push access OK"
+        env:
+          GITHUB_TOKEN: ${{ secrets.JAVA_RELEASE_TOKEN }}
+
+      - name: Verify JAVA_RELEASE_GITHUB_TOKEN can trigger workflows
+        run: |
+          # JAVA_RELEASE_GITHUB_TOKEN is used for:
+          #   - gh workflow run release-changelog.lock.yml (requires actions:write)
+          # Verify it can access the actions API on this repo.
+          gh api repos/${{ github.repository }}/actions/workflows --jq '.total_count' > /dev/null 2>&1 || {
+            echo "::error::JAVA_RELEASE_GITHUB_TOKEN cannot access workflows API on ${{ github.repository }}. It needs actions:write to trigger changelog generation."
+            exit 1
+          }
+          echo "JAVA_RELEASE_GITHUB_TOKEN workflow access OK"
+        env:
+          GITHUB_TOKEN: ${{ secrets.JAVA_RELEASE_GITHUB_TOKEN }}
+
   publish-maven:
     name: Publish Java SDK to Maven Central
+    needs: preflight
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -177,7 +211,7 @@ jobs:
 
   github-release:
     name: Create GitHub Release
-    needs: publish-maven
+    needs: [preflight, publish-maven]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     defaults:
diff --git a/.github/workflows/java.notes.template b/.github/workflows/java.notes.template
index bec50a91b..d34d39c62 100644
--- a/.github/workflows/java.notes.template
+++ b/.github/workflows/java.notes.template
@@ -1,10 +1,11 @@
+<!-- INSTALLATION_SECTION: preserve this section verbatim when updating release notes -->
+<!-- maven_central_url: https://central.sonatype.com/artifact/${GROUP_ID}/${ARTIFACT_ID}/${VERSION} -->
 # Installation
 
-ℹ️ **Public Preview:** This is the official Java SDK for GitHub Copilot. This repository treats the official .NET and Node.js SDKs for GitHub Copilot as reference implementations. These SDKs are all officially supported as GitHub open source projects. The Java implementation follows the backward compatibility guarantees offered by the reference implementations.
-
 ⚠️ **Artifact versioning plan:** Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form `vMaj.Min.Micro`. For example v0.1.32. The corresponding maven version for the release will be `Maj.Min.Micro-java.N`, where `Maj`, `Min` and `Micro` are the corresponding numbers for the reference implementation release, and `N` is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the `docs/adr` directory of the source code.
-  
+
 📦 [View on Maven Central](https://central.sonatype.com/artifact/${GROUP_ID}/${ARTIFACT_ID}/${VERSION})
+<!-- END_INSTALLATION_SECTION -->
 
 ## Maven
 ```xml
diff --git a/.github/workflows/release-changelog.md b/.github/workflows/release-changelog.md
index d82365ac5..52af777cd 100644
--- a/.github/workflows/release-changelog.md
+++ b/.github/workflows/release-changelog.md
@@ -117,6 +117,11 @@ Use the `create-pull-request` output to submit your changes. The PR should:
 
 Use the `update-release` output to replace the auto-generated release notes with your nicely formatted changelog. **Do not include the version heading** (`## [vX.Y.Z](...) (date)`) in the release notes — the release already has a title showing the version. Start directly with the feature sections or other changes list.
 
+**IMPORTANT — Preserving the Installation section:**
+The release body may contain an Installation section delimited by `<!-- INSTALLATION_SECTION -->` and `<!-- END_INSTALLATION_SECTION -->` HTML comments. In the case of Java, this section includes Maven/Gradle dependency snippets and a "View on Maven Central" link. You **MUST** preserve this entire section (from the opening comment through the closing comment, inclusive) exactly as it appears in the existing release body. Place your generated changelog content **after** the Installation section.
+
+**URL reconstruction:** If the Maven Central URL in the Installation section appears corrupted or contains the word "redacted", reconstruct it. Extract the version from the release tag (e.g., `java/v1.0.0` → `1.0.0`), and rebuild the URL as: `https://central.sonatype.com/artifact/com.github/copilot-sdk-java/{VERSION}`. The `<!-- maven_central_url -->` HTML comment in the section contains the intended URL pattern.
+
 ## Example Output
 
 Here is an example of what a changelog entry should look like, based on real commits from this repo. **Follow this style exactly.**