@@ -74,33 +74,40 @@ function release {
 
   local version=${REF_NAME#v}
 
-  # Set the workspace version to match the release tag
-  sed -i "s/^version = \".*\"/version = \"$version\"/" Cargo.toml
-
   # Generated files must exist (created during build step, or generate now)
   if [ ! -d barretenberg-rs/src/generated ]; then
     echo "Generated files not found, generating..."
     generate
   fi
 
-  # ipc-runtime's release (which runs first) publishes its crate at this
-  # version; pin that exact build.
-  sed -i -E "s|^(ipc-runtime = \{ path = \"[^\"]*\", version = \")[^\"]*|\1=$version|" barretenberg-rs/Cargo.toml
-
   # Check if this version is already published on crates.io (idempotent re-runs).
   if crate_published barretenberg-rs $version; then
     echo "barretenberg-rs@$version already published on crates.io. Skipping."
     return 0
   fi
 
-  # Publish to crates.io (--allow-dirty because version was just set and generated files are gitignored)
+  # Publish from a staged copy so the checkout is left untouched. ipc-runtime's
+  # crate is staged beside it, at the same relative path and at this version, so
+  # the path dependency resolves; ipc-runtime's release (which runs first)
+  # publishes that build, and the version pin below names it exactly.
+  local stage=$(mktemp -d)
+  local dest=$stage/barretenberg/rust
+  "$root/ipc-runtime/bootstrap.sh" stage_crate $version $stage
+  mkdir -p $dest
+  tar -c --exclude=./target . | tar -x -C $dest
+  sed -i "s/^version = \".*\"/version = \"$version\"/" $dest/Cargo.toml
+  sed -i -E "s|^(ipc-runtime = \{ path = \"[^\"]*\", version = \")[^\"]*|\1=$version|" $dest/barretenberg-rs/Cargo.toml
+
+  # --allow-dirty because generated files are gitignored
   local extra_flags=""
   if ! gh release view "v$version" --repo AztecProtocol/barretenberg &>/dev/null; then
     # No matching GitHub release yet — skip verification build (which would try to download libbb-external.a)
     echo "No GitHub release found for v$version, adding --no-verify (pass REF_NAME matching a release for full verification)"
     extra_flags="--no-verify"
   fi
-  BB_LIB_DIR="$(cd ../cpp/build/lib && pwd)" retry "denoise 'do_or_dryrun cargo publish --allow-dirty $extra_flags -p barretenberg-rs'"
+  local bb_lib_dir="$(cd ../cpp/build/lib && pwd)"
+  (cd $dest && BB_LIB_DIR="$bb_lib_dir" retry "denoise 'do_or_dryrun cargo publish --allow-dirty $extra_flags -p barretenberg-rs'")
+  rm -rf $stage
 }
 
 function test_download {
 
@@ -71,6 +71,18 @@ function crate_published {
   curl -sf -H "User-Agent: aztec-packages-ci (tech@aztec-labs.com)" "https://crates.io/api/v1/crates/ipc-runtime/$1" | jq -e '.version.num' &>/dev/null
 }
 
+# Stage the publishable crate, at <version>, in <dir>/ipc-runtime/rust. The
+# checkout is left untouched: other projects hash these files later in the run.
+# The crate compiles the C++ runtime itself, so it ships a copy of the sources.
+function stage_crate {
+  local version=$1 dest=$2/ipc-runtime/rust
+  mkdir -p $dest/cpp
+  cp -r rust/Cargo.toml rust/build.rs rust/src $dest/
+  cp -r cpp/ipc_runtime $dest/cpp/
+  find $dest/cpp -name '*.test.cpp' -delete
+  sed -i "0,/^version = \".*\"/s//version = \"$version\"/" $dest/Cargo.toml
+}
+
 # Publish the Rust crate to crates.io. barretenberg-rs depends on it at the
 # same version, and its release runs after this one.
 function release_crate {
@@ -81,16 +93,12 @@ function release_crate {
     return 0
   fi
 
-  # The crate compiles the C++ runtime itself, so it ships a copy of the sources.
-  rm -rf rust/cpp
-  mkdir -p rust/cpp
-  cp -r cpp/ipc_runtime rust/cpp/
-  find rust/cpp -name '*.test.cpp' -delete
-  sed -i "0,/^version = \".*\"/s//version = \"$version\"/" rust/Cargo.toml
-
+  local stage=$(mktemp -d)
+  stage_crate $version $stage
   # Verification builds the packaged crate on its own, which proves the copied
-  # sources are complete.
-  (cd rust && retry "denoise 'do_or_dryrun cargo publish --allow-dirty'")
+  # sources are complete. --allow-dirty in case the temp dir is inside a git repo.
+  (cd $stage/ipc-runtime/rust && retry "denoise 'do_or_dryrun cargo publish --allow-dirty'")
+  rm -rf $stage
 }
 
 function release {