diff --git a/.github/workflows/bundle.yml b/.github/workflows/bundle.yml
index a057cf5..0768ce8 100644
--- a/.github/workflows/bundle.yml
+++ b/.github/workflows/bundle.yml
@@ -16,7 +16,7 @@ name: Single-file build
 
 on:
   push:
-    branches: [main, feat/v2-ui]
+    branches: [main, 'release/**']
   pull_request:
   workflow_dispatch:
 
diff --git a/AGENTS.md b/AGENTS.md
index 04a8845..f12a7e0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -98,11 +98,28 @@ gamescope and the Plasma desktop. Primary target: the Valve Steam Machine
     + subject; a commit can't contain its own hash, so fill it in with the
     next commit). The section heading must be `## <VERSION> - <date>`: CI
     cuts the release notes out of the changelog by that heading.
-  - Every PR that should be released bumps `VERSION` and adds its section.
-    A push to `main` publishes release `v$VERSION` (tag + bundle + that
+  - **Branches: one release branch per version.** Work for a release goes
+    into `release/X.Y.Z` (e.g. `release/2.7.0`), branched from `main` when
+    that version starts. That branch bumps `VERSION` to `X.Y.Z` and adds the
+    `## X.Y.Z - <date>` changelog section (first commit on it).
+    - Every change gets its own branch from the release branch:
+      `feature/<name>` (new behaviour) or `bugfix/<name>` (a fix), and a
+      pull request **into the release branch**, not into `main`. Its commits
+      add their changelog lines to that version's section.
+    - When the release is done and tested (the test plan in
+      steamify-cachyos-dev, `TESTPLAN.md`), the release branch gets a pull
+      request **into `main`**. Merging it publishes the release (below).
+    - A fix for a released version: a new `release/X.Y.Z+1` from `main`,
+      with the `bugfix/` branch into it; don't reopen an old release branch.
+    - Never commit to `main` directly; the user merges the pull requests.
+      Keep a feature/bugfix branch up to date by merging (or rebasing on)
+      its release branch, the release branch by merging `main` when that
+      moved.
+  - A push to `main` publishes release `v$VERSION` (tag + bundle + that
     changelog section) and marks it latest. An existing version is never
     overwritten: without a bump nothing is released, and pull requests show
-    a warning.
+    a warning when `VERSION` is a version that's already released (so a
+    release branch that forgot its bump shows it on every PR).
   - A release that adds, removes or renames a menu row also retakes the
     README screenshot (`assets/screenshot-menu.png`): the app from the
     branch on a Steam Machine, every row visible (window 1280 wide, tall
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab91c6a..c2833e9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,8 @@ one per merged pull request.
 - `4f6e6fd` **feat: --defaults takes --skip <ids> and --boot gamescope|desktop, for the Steam Machine ISO's installer pages**
 - `5bf9da4` **fix: HDMI-CEC enables cec-audio-control.socket (the TV remote's volume keys); existing installs get it as an update**
 - `14aa7c0` **fix: the app's progress screen says "Boot into desktop", not "Boot into Boot into"**
-- **feat: --defaults --options <ids> (exactly these on) replaces --skip; steamify.sh --boot gamescope|desktop on its own switches where an installed conversion starts**
+- `c4ec755` **feat: --defaults --options <ids> (exactly these on) replaces --skip; steamify.sh --boot gamescope|desktop on its own switches where an installed conversion starts**
+- **docs: release branches (release/X.Y.Z, feature/ and bugfix/ branches into it, the release into main); CI builds release/** pushes**
 
 ## 2.6.0 - 2026-09-27