diff --git a/.circleci/config.yml b/.circleci/config.yml
index 4d06140..653eb4b 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -3,20 +3,36 @@ version: 2.1
 orbs:
    qqq-orb: kingsrook/qqq-orb@0.6.0
 
+commands:
+   configure-package-install:
+      steps:
+         - run:
+              name: Keep package installation unattended
+              command: |
+                 # These build machines are discarded after the job; without this,
+                 # needrestart blocks apt in "Install Java" until the 10m no-output timeout.
+                 sudo install -d /etc/needrestart/conf.d
+                 printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null
+
+
 workflows:
    test_only:
       jobs:
          - qqq-orb/mvn_test_only:
+              pre-steps:
+                 - configure-package-install
               context: [qqq-maven-registry-credentials]
               filters:
                  branches:
-                    ignore: /(develop|main|release\/.*|hotfix\/.*|integration.*)/
+                    ignore: /(develop|main|release\/.*|integration.*)/
                  tags:
                     only: []
 
    publish_snapshot:
       jobs:
          - qqq-orb/mvn_publish:
+              pre-steps:
+                 - configure-package-install
               context: [qqq-maven-registry-credentials]
               branch_type: snapshot
               filters:
@@ -26,6 +42,8 @@ workflows:
    publish_release_candidate:
       jobs:
          - qqq-orb/mvn_publish:
+              pre-steps:
+                 - configure-package-install
               context: [qqq-maven-registry-credentials]
               branch_type: release_candidate
               filters:
@@ -35,6 +53,8 @@ workflows:
    publish_release:
       jobs:
          - qqq-orb/mvn_publish:
+              pre-steps:
+                 - configure-package-install
               context: [qqq-maven-registry-credentials]
               branch_type: release
               filters:
@@ -42,12 +62,3 @@ workflows:
                     only: [main]
                  tags:
                     only: [/^v\d+\.\d+\.\d+$/]
-
-   publish_hotfix_release:
-      jobs:
-         - qqq-orb/mvn_publish:
-              context: [qqq-maven-registry-credentials]
-              branch_type: hotfix
-              filters:
-                 branches:
-                    only: [/hotfix\/.*/]
diff --git a/.github/workflows/release-rc.yml b/.github/workflows/release-rc.yml
new file mode 100644
index 0000000..dd332a0
--- /dev/null
+++ b/.github/workflows/release-rc.yml
@@ -0,0 +1,25 @@
+# Cut the next release candidate (QRun-IO/qqq docs/QRUN-QBIT-REPO-STANDARD.md, C6):
+# run this workflow by hand, or merge a develop PR labelled `release:rc`. It merges develop into
+# the release line and the release/* push runs CircleCI publish_release_candidate.
+name: Release candidate
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Print the plan without merging or creating branches
+        type: boolean
+        default: false
+  pull_request:
+    types: [closed]
+    branches: [develop]
+
+permissions:
+  contents: write
+
+jobs:
+  release-rc:
+    if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release:rc'))
+    uses: QRun-IO/.github/.github/workflows/qbit-release-rc.yml@main
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}