diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index ecee45a6d8..e78fe1ea3b 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -11,7 +11,8 @@ permissions:
 
 concurrency:
   group: sonarcloud-${{ github.ref }}
-  cancel-in-progress: true
+  # A push to main is the run that publishes coverage; superseded runs there would never finish.
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
   sonarcloud:
diff --git a/Cargo.lock b/Cargo.lock
index 69a1e38e9e..8f3ef03ecf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4839,7 +4839,7 @@ dependencies = [
  "photocraft-text",
  "photocraft-vector",
  "rayon",
- "roxmltree 0.20.0",
+ "roxmltree 0.21.1",
  "same-file",
  "semver",
  "serde",
@@ -4931,7 +4931,7 @@ dependencies = [
  "photocraft-vector",
  "proptest",
  "resvg",
- "roxmltree 0.20.0",
+ "roxmltree 0.21.1",
  "serde_json",
  "thiserror 2.0.21",
 ]
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index fdf2ac0a00..0db3487c56 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -38,7 +38,7 @@ craft-print = { workspace = true }
 
 # Photoshop `.kys` shortcut sets (`edit.keyboardShortcuts` `importKys`); already in the tree
 # through photocraft-ui-egui and usvg.
-roxmltree = "0.20"
+roxmltree = "0.21"
 # Release tags use the same semantic versions as Cargo.
 semver = "1"
 
diff --git a/crates/io/Cargo.toml b/crates/io/Cargo.toml
index 261c16481c..9b4ab1f416 100644
--- a/crates/io/Cargo.toml
+++ b/crates/io/Cargo.toml
@@ -39,7 +39,7 @@ blake3 = { version = "1.8", default-features = false, features = ["pure"] }
 # pdn.rs inflates Paint.NET's gzip pixel chunks.
 flate2 = { workspace = true }
 # ora.rs reads OpenRaster's stack.xml (already in the tree through usvg).
-roxmltree = "0.20"
+roxmltree = "0.21"
 # SVG import (svg.rs): usvg parses, resvg rasterises what the shape model can't hold. Both are
 # already in the tree through the UI's icon loader; text shaping needs the fonts feature set.
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index 1b0974a340..b4be928efd 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -97,6 +97,24 @@ notarize() {
   fi
 }
 
+# Stapling and validating both look the ticket up in Apple's CloudKit service. Right after
+# notarization that lookup can drop the connection ("The network connection was lost", error 68)
+# even though the ticket exists, so retry the pair a few times before failing the release.
+staple() {
+  local file="$1" attempt
+  for attempt in 1 2 3 4 5; do
+    if xcrun stapler staple "$file" && xcrun stapler validate "$file"; then
+      return
+    fi
+    if [ "$attempt" = 5 ]; then
+      echo "error: stapling $(basename "$file") failed after $attempt attempts" >&2
+      exit 1
+    fi
+    echo "stapling $(basename "$file") failed (attempt $attempt); retrying in $((attempt * 20))s" >&2
+    sleep $((attempt * 20))
+  done
+}
+
 # ---- PhotoCraft.app ----------------------------------------------------------------------------
 echo "==> assembling $APP"
 mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
@@ -123,8 +141,7 @@ codesign --verify --strict --deep --verbose=2 "$APP"
 if [[ "$NOTARIZE" = 1 ]]; then
   ditto -c -k --keepParent "$APP" "$WORK/PhotoCraft-notarize.zip"
   notarize "$WORK/PhotoCraft-notarize.zip"
-  xcrun stapler staple "$APP"
-  xcrun stapler validate "$APP"
+  staple "$APP"
   spctl --assess --type execute -vvv "$APP"
 fi
 
@@ -149,8 +166,7 @@ sign "$DMG"
 codesign --verify --strict --verbose=2 "$DMG"
 if [[ "$NOTARIZE" = 1 ]]; then
   notarize "$DMG"
-  xcrun stapler staple "$DMG"
-  xcrun stapler validate "$DMG"
+  staple "$DMG"
   spctl --assess --type open --context context:primary-signature -vvv "$DMG"
 fi
 
diff --git a/packaging/macos/verify.sh b/packaging/macos/verify.sh
index 7521d44e03..46f779c2cf 100755
--- a/packaging/macos/verify.sh
+++ b/packaging/macos/verify.sh
@@ -70,6 +70,17 @@ assess() {
   return 1
 }
 
+# `stapler validate` asks Apple's CloudKit service too, which sometimes drops the connection
+# (error 68) though the ticket is there.
+validate_staple() {
+  local attempt
+  for attempt in 1 2 3 4 5; do
+    xcrun stapler validate "$1" && return 0
+    [[ "$attempt" = 5 ]] || sleep $((attempt * 20))
+  done
+  return 1
+}
+
 for f in "$DMG" "$CLI_ZIP"; do
   if [[ ! -f "$f" ]]; then
     echo "error: missing $f" >&2
@@ -126,7 +137,7 @@ fi
 echo "==> $(basename "$DMG")"
 codesign --verify --strict --verbose=2 "$DMG"
 if [[ "$STRICT" = 1 ]]; then
-  xcrun stapler validate "$DMG" || fail "no notarization ticket stapled to the DMG"
+  validate_staple "$DMG" || fail "no notarization ticket stapled to the DMG"
   assess --assess --type open --context context:primary-signature -vv "$DMG" \
     || fail "Gatekeeper rejects the DMG"
 fi
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 545bce9d23..0a90684252 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -231,8 +231,9 @@ fn cmd_gate_tests(panic_hunt: bool) -> Result<(), String> {
             c.args(["--run-ignored", "only", "-E", "binary_id(photocraft-engine::panic_hunt)"]);
         }
     } else if panic_hunt {
-        // `-- --ignored` across the workspace would run every ignored test, not only the hunt.
-        c.args(["test", "-p", "photocraft-engine", "--locked", "--test", "panic_hunt", "--", "--ignored"]);
+        // `-- --ignored` across the workspace would run every ignored test, not only the hunt. The
+        // engine has no `heif` feature of its own; it reaches the decoder through photocraft-io.
+        c.args(["test", "-p", "photocraft-engine", "--locked", "--features", "photocraft-io/heif", "--test", "panic_hunt", "--", "--ignored"]);
     } else {
         eprintln!("note: cargo-nextest is not installed, running cargo test (cargo install cargo-nextest --locked)");
         c.arg("test").args(GATE_ARGS).args(&TEST_TARGETS[1..]);