diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d959c09d8e..1704e861dc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,9 +24,9 @@ jobs:
           distribution: 'zulu'
           java-version-file: .github/workflows/.java-version
 
-      - uses: gradle/actions/setup-gradle@v5
+      - uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6 # zizmor: ignore[cache-poisoning]
         with:
-          cache-read-only: false
+          cache-read-only: ${{ github.ref != 'refs/heads/master' }}
 
       - name: Check test files
         run: |
@@ -53,12 +53,12 @@ jobs:
           distribution: 'zulu'
           java-version-file: .github/workflows/.java-version
 
-      - uses: gradle/actions/setup-gradle@v5
+      - uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6 # zizmor: ignore[cache-poisoning]
         with:
-          cache-read-only: false
+          cache-read-only: ${{ github.ref != 'refs/heads/master' }}
 
       - name: Setup Xcode
-        uses: maxim-lobanov/setup-xcode@v1
+        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
         with:
           xcode-version: '26.1.1'
 
@@ -91,9 +91,9 @@ jobs:
           distribution: 'zulu'
           java-version-file: .github/workflows/.java-version
 
-      - uses: gradle/actions/setup-gradle@v5
+      - uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6 # zizmor: ignore[cache-poisoning]
         with:
-          cache-read-only: false
+          cache-read-only: ${{ github.ref != 'refs/heads/master' }}
 
       - name: Check test files
         run: |
@@ -125,12 +125,12 @@ jobs:
           distribution: 'zulu'
           java-version-file: .github/workflows/.java-version
 
-      - uses: gradle/actions/setup-gradle@v5
+      - uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6 # zizmor: ignore[cache-poisoning]
         with:
-          cache-read-only: false
+          cache-read-only: ${{ github.ref != 'refs/heads/master' }}
 
       - name: Setup Xcode
-        uses: maxim-lobanov/setup-xcode@v1
+        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
         with:
           xcode-version: '26.1.1'
 
@@ -183,9 +183,9 @@ jobs:
           distribution: 'zulu'
           java-version-file: .github/workflows/.java-version
 
-      - uses: gradle/actions/setup-gradle@v5
+      - uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6 # zizmor: ignore[cache-poisoning]
         with:
-          cache-read-only: false
+          cache-read-only: ${{ github.ref != 'refs/heads/master' }}
 
       - name: Run Tests
         uses: reactivecircus/android-emulator-runner@v2
@@ -194,32 +194,3 @@ jobs:
           script: ./gradlew --stacktrace -Pswift=false connectedCheck
         env:
           API_LEVEL: ${{ matrix.api-level }}
-
-  publish-snapshot:
-    runs-on: macos-latest
-    if: github.repository == 'square/wire' && github.ref == 'refs/heads/master'
-    needs: [jvm, multiplatform, swift]
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - uses: actions/setup-java@v5
-        with:
-          distribution: 'zulu'
-          java-version-file: .github/workflows/.java-version
-
-      - name: Setup Xcode
-        uses: maxim-lobanov/setup-xcode@v1
-        with:
-          xcode-version: '26.1.1'
-
-      # We set `SDKROOT` as a workaround for https://github.com/gradle/gradle/pull/29227
-      - name: Upload Artifacts
-        run: |
-          SDKROOT=$(xcrun -sdk macosx --show-sdk-path) ./gradlew publish --stacktrace --warning-mode all --no-daemon
-        env:
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_CENTRAL_USERNAME }}
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_CENTRAL_PASSWORD }}
-          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_SECRET_KEY }}
-          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_SECRET_PASSPHRASE }}
diff --git a/.github/workflows/gradle-wrapper.yaml b/.github/workflows/gradle-wrapper.yaml
index 1736a0c0b9..266ef38d56 100644
--- a/.github/workflows/gradle-wrapper.yaml
+++ b/.github/workflows/gradle-wrapper.yaml
@@ -12,5 +12,5 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: gradle/actions/wrapper-validation@v5
+      - uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6
 
diff --git a/.github/workflows/publish-snapshot.yml b/.github/workflows/publish-snapshot.yml
new file mode 100644
index 0000000000..1f503148e2
--- /dev/null
+++ b/.github/workflows/publish-snapshot.yml
@@ -0,0 +1,43 @@
+name: publish-snapshot
+
+on:
+  push:
+    branches:
+      - 'master'
+    tags-ignore:
+      - '**'
+
+env:
+  GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx4g -Dorg.gradle.daemon=false -Dkotlin.incremental=false"
+
+permissions:
+  contents: read
+
+jobs:
+  publish-snapshot:
+    runs-on: macos-latest
+    if: github.repository == 'square/wire'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version-file: .github/workflows/.java-version
+
+      - name: Setup Xcode
+        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
+        with:
+          xcode-version: '26.1.1'
+
+      # We set `SDKROOT` as a workaround for https://github.com/gradle/gradle/pull/29227
+      - name: Upload Artifacts
+        run: |
+          SDKROOT=$(xcrun -sdk macosx --show-sdk-path) ./gradlew publish --stacktrace --warning-mode all --no-daemon
+        env:
+          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_CENTRAL_USERNAME }}
+          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_CENTRAL_PASSWORD }}
+          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.GPG_SECRET_KEY }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.GPG_SECRET_PASSPHRASE }}