diff --git a/.github/workflows/pages-repo.yml b/.github/workflows/pages-repo.yml
index bfacff7..2cef78d 100644
--- a/.github/workflows/pages-repo.yml
+++ b/.github/workflows/pages-repo.yml
@@ -5,36 +5,76 @@ on:
     branches: [ main, "rework/v2" ]
   workflow_dispatch:
 
+# Shared with JavaDoc publishing so Maven-layout and docs pushes to
+# Pinont/singularity-maven gh-pages do not race.
+concurrency:
+  group: singularity-maven-gh-pages
+  cancel-in-progress: false
+
 jobs:
   deploy:
     # Pushes the maven repo layout to Pinont/singularity-maven (Pages-served,
     # anonymous reads). Accumulative: previously published versions are kept.
+    # JavaDoc HTML lives under /javadoc/ — overlay only; do not delete that tree.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          # This job never pushes back to SingularityLib. Leaving the default
+          # persist-credentials extraheader (GITHUB_TOKEN) in place makes
+          # later git clone/push to Pinont/singularity-maven use the wrong
+          # token: clone of a public repo still succeeds, then `git push`
+          # fails with "Invalid username or token" (run 33554760652).
+          persist-credentials: false
       - name: Setup JDK 25
         uses: actions/setup-java@v4
         with:
           distribution: temurin
           java-version: '25'
+      - name: Install annotation processor module
+        # singularitylib-processor is a standalone module (the root pom is a jar,
+        # not an aggregator), so install it into the local repo first — the lib
+        # compiles against it via annotationProcessorPaths. Same step as build.yml.
+        run: mvn -q install -f singularitylib-processor/pom.xml
       - name: Stage maven repo layout
-        run: mvn -q clean deploy -DskipTests -DaltDeploymentRepository=pages::default::file:${{ github.workspace }}/staging
+        # File-repo deploy. maven.pinont.me serves group paths at the Pages root
+        # (https://maven.pinont.me/io/github/pinont/...), not under /repo/.
+        run: |
+          STAGING="${{ github.workspace }}/staging"
+          mvn -q deploy -f singularitylib-processor/pom.xml -DskipTests \
+            -DaltDeploymentRepository=pages::default::file:${STAGING}
+          mvn -q clean deploy -DskipTests \
+            -DaltDeploymentRepository=pages::default::file:${STAGING}
       - name: Clone target repo (gh-pages branch)
+        # Clone into runner.temp — Maven's `target/` already exists after deploy,
+        # so `git clone … target` would fail (non-empty destination).
+        env:
+          MAVEN_REPO_TOKEN: ${{ secrets.MAVEN_REPO_TOKEN }}
         run: |
-          git clone --depth 1 --branch gh-pages "https://x-access-token:${{ secrets.MAVEN_REPO_TOKEN }}@github.com/Pinont/singularity-maven.git" target || {
-            cd target 2>/dev/null || git clone "https://x-access-token:${{ secrets.MAVEN_REPO_TOKEN }}@github.com/Pinont/singularity-maven.git" target
-            cd target && git checkout -b gh-pages || true
+          DEST="${{ runner.temp }}/singularity-maven"
+          AUTH_URL="https://x-access-token:${MAVEN_REPO_TOKEN}@github.com/Pinont/singularity-maven.git"
+          git -c "http.https://github.com/.extraheader=" clone --depth 1 --branch gh-pages "$AUTH_URL" "$DEST" || {
+            git -c "http.https://github.com/.extraheader=" clone "$AUTH_URL" "$DEST"
+            git -C "$DEST" checkout -b gh-pages || true
           }
+          git -C "$DEST" remote set-url origin "$AUTH_URL"
       - name: Sync artifacts in (accumulative)
+        env:
+          MAVEN_REPO_TOKEN: ${{ secrets.MAVEN_REPO_TOKEN }}
         run: |
-          mkdir -p target/repo
-          cp -R staging/. target/repo/
-          cd target
+          DEST="${{ runner.temp }}/singularity-maven"
+          AUTH_URL="https://x-access-token:${MAVEN_REPO_TOKEN}@github.com/Pinont/singularity-maven.git"
+          # Overlay onto gh-pages root (io/, com/, …). Do not nest under repo/,
+          # and do not delete javadoc/, CNAME, or .nojekyll.
+          cp -R staging/. "$DEST/"
+          cd "$DEST"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote set-url origin "$AUTH_URL"
           git add -A
           git diff --cached --quiet && echo "No changes" || git commit -m "publish ${{ github.sha }}"
-          git push origin gh-pages
+          # Blank extraheader so a leftover GITHUB_TOKEN cannot override the PAT.
+          git -c "http.https://github.com/.extraheader=" push origin gh-pages
       - name: Trigger Pages rebuild
         run: |
           curl -s -X POST \