diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf3ea2c..06b252c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -64,6 +64,11 @@ jobs:
     env:
       MODULE: ${{ needs.resolve.outputs.module }}
       THRESHOLD: "80"
+      # Every released module must build standalone: SDK-backed modules like
+      # source/kafka are deliberately excluded from go.work, so building them
+      # with the root workspace present fails outright. Disable the workspace
+      # for the whole gate; replace directives cover intra-repo dependencies.
+      GOWORK: "off"
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -80,7 +85,12 @@ jobs:
       - name: govulncheck
         working-directory: ${{ env.MODULE }}
         run: go run "$GOVULNCHECK" ./...
+      # Lint runs only on the newest Go leg: golangci-lint is compiled by the
+      # active toolchain, and an older one (go1.25) refuses a module targeting
+      # a newer language version (module toolchain directives), which would
+      # fail the 1.25.x legs spuriously. Test -race still covers those legs.
       - name: golangci-lint
+        if: matrix.go == '1.26.6'
         working-directory: ${{ env.MODULE }}
         run: go run "$GOLANGCI_LINT" run --config "$GITHUB_WORKSPACE/.golangci.yml" ./...
       - name: coverage gate
diff --git a/source/CHANGELOG.md b/source/CHANGELOG.md
index 5adb7ca..53689c5 100644
--- a/source/CHANGELOG.md
+++ b/source/CHANGELOG.md
@@ -5,6 +5,14 @@ All notable changes to `crucible/source` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.1] — 2026-08-23
+
+Release engineering only: no code changes. The v1.0.0 tag's release workflow
+failed for environment reasons (the validate job built with the repository
+workspace present, and golangci-lint could not run on the Go 1.25 matrix leg
+against a module targeting a newer language version); v1.0.1 republishes the
+identical source so the tag validates cleanly end to end.
+
 ## [1.0.0] — 2026-08-23
 
 The first stable release. It freezes the neutral ingress surface — `Inlet`,
diff --git a/source/kafka/CHANGELOG.md b/source/kafka/CHANGELOG.md
index 324fa36..7a9ce0d 100644
--- a/source/kafka/CHANGELOG.md
+++ b/source/kafka/CHANGELOG.md
@@ -5,6 +5,14 @@ All notable changes to `crucible/source/kafka` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.1] — 2026-08-23
+
+Release engineering only: no code changes. The v1.0.0 tag's release workflow
+failed for environment reasons (the validate job built with the repository
+workspace present, and golangci-lint could not run on the Go 1.25 matrix leg
+against a module targeting a newer language version); v1.0.1 republishes the
+identical source so the tag validates cleanly end to end.
+
 ## [1.0.0] — 2026-08-23
 
 The first stable release. It freezes the adapter surface — `Inlet` with `New`