diff --git a/.github/actions/setup-maven/action.yml b/.github/actions/setup-maven/action.yml
new file mode 100644
index 00000000..23611476
--- /dev/null
+++ b/.github/actions/setup-maven/action.yml
@@ -0,0 +1,17 @@
+name: Set up the release Maven toolchain
+description: Install the Maven version tested with the Central publishing plugin
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        RELEASE_MAVEN_VERSION: '3.9.16'
+        RELEASE_MAVEN_SHA512: 831a8591fe20c8243b1dbe7d71e3244f31d1665b0804b2e825e38cbbe5ce0cafb8338851f90780735568773e0a6cd07bbec107cda0b896b008b861075358b6f6
+      run: |
+        archive="$RUNNER_TEMP/apache-maven-$RELEASE_MAVEN_VERSION-bin.tar.gz"
+        curl --fail --location --silent --show-error --retry 3 \
+          "https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/$RELEASE_MAVEN_VERSION/apache-maven-$RELEASE_MAVEN_VERSION-bin.tar.gz" \
+          --output "$archive"
+        printf '%s  %s\n' "$RELEASE_MAVEN_SHA512" "$archive" | sha512sum --check
+        tar -xzf "$archive" -C "$RUNNER_TEMP"
+        echo "$RUNNER_TEMP/apache-maven-$RELEASE_MAVEN_VERSION/bin" >> "$GITHUB_PATH"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5187da5b..eb10fd5c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,6 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup-maven
       - uses: actions/setup-java@v5
         with:
           distribution: temurin
@@ -35,6 +36,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
+      # Maven 3.10 writes Resolver metadata into the Central staging tree,
+      # which makes the portal reject an otherwise complete release bundle.
+      - uses: ./.github/actions/setup-maven
+
       - name: Set up Java
         uses: actions/setup-java@v5
         with:
@@ -54,7 +59,9 @@ jobs:
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
 
       - name: Deploy to Maven Central (signed)
-        run: mvn -B clean deploy -Pcentral -Dgpg.executable=gpg
+        run: |
+          mvn --version
+          mvn -B clean deploy -Pcentral -Dgpg.executable=gpg
         env:
           MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}