diff --git a/.github/workflows/release-metadata.yml b/.github/workflows/release-metadata.yml
index c69f7d1817..d0270756e6 100644
--- a/.github/workflows/release-metadata.yml
+++ b/.github/workflows/release-metadata.yml
@@ -37,7 +37,7 @@ jobs:
 
       - id: release
         name: Validate release consumer
-        uses: LibreCodeCoop/github-workflows/actions/validate-release-consumer@b0f1a51911ed5424a0dfa1ff0cb732cbd57c3d4c
+        uses: LibreCodeCoop/github-workflows/actions/validate-release-consumer@83fdddeb3efe9b9e464e1f5c2e2772322af94fc8
 
       - name: Verify packaging changelog mapping
         env:
diff --git a/.nextcloud-release.yml b/.nextcloud-release.yml
index 4d0c7c767c..e176846b76 100644
--- a/.nextcloud-release.yml
+++ b/.nextcloud-release.yml
@@ -39,3 +39,40 @@ package:
     - make
     - appstore
     - verify-appstore-package
+  required_paths:
+    - appinfo
+    - composer
+    - css
+    - img
+    - js
+    - l10n
+    - lib
+    - templates
+    - vendor
+    - 3rdparty
+    - openapi.json
+    - openapi-administration.json
+    - openapi-full.json
+    - tests/php/fixtures/pdfs/small_valid.pdf
+  forbidden_paths:
+    - .git
+    - .github
+    - .devcontainer
+    - .patches
+    - build
+    - docs
+    - node_modules
+    - playwright
+    - src
+    - vendor-bin
+    - img/screenshot
+    - 3rdparty/.git
+    - 3rdparty/.github
+    - 3rdparty/vendor
+    - 3rdparty/vendor-bin
+    - 3rdparty/scoper.inc.php
+
+publication:
+  publisher_workflow: appstore-build-publish.yml
+  asset_name: '{app}-{tag}.tar.gz'
+  appstore_api: https://apps.nextcloud.com/api/v1/apps.json