diff --git a/.github/workflows/extension-release.yml b/.github/workflows/extension-release.yml
index 9db8a6e..3f51e14 100644
--- a/.github/workflows/extension-release.yml
+++ b/.github/workflows/extension-release.yml
@@ -20,10 +20,10 @@ jobs:
       run:
         working-directory: clients/vscode
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: "20"
+          node-version: "22"
 
       - run: npm ci
       - run: npm run compile && npm test
@@ -53,8 +53,14 @@ jobs:
       - name: Attach .vsix to a GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
+        # Idempotent: a re-run (e.g. after configuring a publish PAT) must not fail
+        # just because the release already exists — upload/clobber the asset instead.
         run: |
-          gh release create "$GITHUB_REF_NAME" *.vsix \
-            --title "$GITHUB_REF_NAME" \
-            --notes "gate VS Code / Cursor extension $GITHUB_REF_NAME" \
-            --verify-tag
+          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
+            gh release upload "$GITHUB_REF_NAME" *.vsix --clobber
+          else
+            gh release create "$GITHUB_REF_NAME" *.vsix \
+              --title "$GITHUB_REF_NAME" \
+              --notes "gate VS Code / Cursor extension $GITHUB_REF_NAME" \
+              --verify-tag
+          fi