diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a969b145..9aeffca5 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -23,6 +23,14 @@ jobs:
       - name: Restore Rust cache
         uses: Swatinem/rust-cache@v2
 
+      # Same as ci.yaml: the secret-scan confinement tests fail (rather than
+      # skip) in CI without a working bubblewrap.
+      - name: Install bubblewrap
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y bubblewrap apparmor-profiles
+          sudo apparmor_parser -r /usr/share/apparmor/extra-profiles/bwrap-userns-restrict
+
       - name: Run tests
         run: cargo test --locked