diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7ff834e5..60617434 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,8 +34,9 @@ on:
         default: false
 
 permissions:
-  contents: write   
-  id-token: write   
+  contents: write        # push the release tag and the version-bump branch
+  id-token: write        # OIDC for the Maven Central release role
+  pull-requests: write   # open the post-release version-bump PR into main
 
 # Serialize all releases repo-wide to avoid concurrent pushes racing on the
 # default branch. Never cancel in-flight: it could leave a half-published state.
@@ -251,10 +252,26 @@ jobs:
             -Darguments="-gs $MAVEN_SETTINGS -Prelease -Dgpg.keyname=$GPG_KEYNAME -Dgpg.passphrase=$GPG_PASSPHRASE" \
             --file "$MODULE/pom.xml"
 
-          # Push commits + tag atomically, only after publish succeeded.
-          git push --atomic origin \
-            "HEAD:${GITHUB_REF_NAME}" \
-            "refs/tags/${MODULE}-${EFFECTIVE_RELEASE_VERSION}"
+      # main is protected (no direct push), so push the tag and open a PR for
+      # the version-bump commits instead. Skipping this would leave the POM on
+      # the just-released -SNAPSHOT.
+      - name: Push release tag and open version-bump PR
+        if: ${{ github.event.inputs.skip_publish != 'true' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${MODULE}-${EFFECTIVE_RELEASE_VERSION}"
+          RELEASE_BRANCH="release/${TAG}"
+
+          # Tag push isn't gated by branch protection; commits go via a PR.
+          git push origin "refs/tags/${TAG}"
+          git push origin "HEAD:refs/heads/${RELEASE_BRANCH}"
+
+          gh pr create \
+            --base "${GITHUB_REF_NAME}" \
+            --head "${RELEASE_BRANCH}" \
+            --title "chore(release): ${MODULE} ${EFFECTIVE_RELEASE_VERSION}" \
+            --body "Post-release version bump for ${MODULE} ${EFFECTIVE_RELEASE_VERSION} (already on Maven Central, tag ${TAG} pushed)."
 
       - name: Dry-run release (prepare only, no publish)
         if: ${{ github.event.inputs.skip_publish == 'true' }}
diff --git a/aws-lambda-java-core/pom.xml b/aws-lambda-java-core/pom.xml
index f45b32fb..7cfba2b8 100644
--- a/aws-lambda-java-core/pom.xml
+++ b/aws-lambda-java-core/pom.xml
@@ -5,7 +5,7 @@
   
   <groupId>com.amazonaws</groupId>
   <artifactId>aws-lambda-java-core</artifactId>
-  <version>1.4.0-SNAPSHOT</version>
+  <version>1.4.1-SNAPSHOT</version>
   <packaging>jar</packaging>
   
   <name>AWS Lambda Java Core Library</name>
diff --git a/aws-lambda-java-events-sdk-transformer/pom.xml b/aws-lambda-java-events-sdk-transformer/pom.xml
index f6602006..4776aabc 100644
--- a/aws-lambda-java-events-sdk-transformer/pom.xml
+++ b/aws-lambda-java-events-sdk-transformer/pom.xml
@@ -5,7 +5,7 @@
 
   <groupId>com.amazonaws</groupId>
   <artifactId>aws-lambda-java-events-sdk-transformer</artifactId>
-  <version>3.1.1-SNAPSHOT</version>
+  <version>3.1.2-SNAPSHOT</version>
   <packaging>jar</packaging>
 
   <name>AWS Lambda Java Events SDK Transformer Library</name>
diff --git a/aws-lambda-java-events/pom.xml b/aws-lambda-java-events/pom.xml
index 0b69b03e..3bef204f 100644
--- a/aws-lambda-java-events/pom.xml
+++ b/aws-lambda-java-events/pom.xml
@@ -5,7 +5,7 @@
 
     <groupId>com.amazonaws</groupId>
     <artifactId>aws-lambda-java-events</artifactId>
-    <version>3.16.1-SNAPSHOT</version>
+    <version>3.16.2-SNAPSHOT</version>
     <packaging>jar</packaging>
 
     <name>AWS Lambda Java Events Library</name>
diff --git a/aws-lambda-java-log4j2/pom.xml b/aws-lambda-java-log4j2/pom.xml
index d136612f..ac1de269 100644
--- a/aws-lambda-java-log4j2/pom.xml
+++ b/aws-lambda-java-log4j2/pom.xml
@@ -5,7 +5,7 @@
 
     <groupId>com.amazonaws</groupId>
     <artifactId>aws-lambda-java-log4j2</artifactId>
-    <version>1.6.4-SNAPSHOT</version>
+    <version>1.6.5-SNAPSHOT</version>
     <packaging>jar</packaging>
 
     <name>AWS Lambda Java Log4j 2.x Libraries</name>
diff --git a/aws-lambda-java-serialization/pom.xml b/aws-lambda-java-serialization/pom.xml
index fbdb93d9..c9285672 100644
--- a/aws-lambda-java-serialization/pom.xml
+++ b/aws-lambda-java-serialization/pom.xml
@@ -4,7 +4,7 @@
 
     <groupId>com.amazonaws</groupId>
     <artifactId>aws-lambda-java-serialization</artifactId>
-    <version>1.4.1-SNAPSHOT</version>
+    <version>1.4.2-SNAPSHOT</version>
     <packaging>jar</packaging>
 
     <name>AWS Lambda Java Runtime Serialization</name>