diff --git a/fastlane/Fastfile b/fastlane/Fastfile
index 71690823c4..e318318bb3 100644
--- a/fastlane/Fastfile
+++ b/fastlane/Fastfile
@@ -274,7 +274,7 @@ lane :finalize_release do |version:, skip_confirm: false|
     Finalizing release #{version}. This will:
     - Bump version to #{version} (remove beta suffix)
     - Trigger a release build for all platforms (macOS, Windows), which will then:
-      - Upload build artifacts to the Apps CDN
+      - Upload build artifacts to the Apps CDN (as drafts, published later by publish_release)
       - Create a draft GitHub release with release notes and download links
       - Notify #dotcom-studio on Slack
   PROMPT
@@ -300,12 +300,16 @@ lane :publish_release do |version:, skip_confirm: false, github_username: nil|
 
   UI.important <<~PROMPT
     Publishing release #{version}. This will:
+    - Publish CDN builds (change post status from draft to publish)
     - Publish the draft GitHub release for v#{version}
     - Create a backmerge PR from `#{release_branch}` into `#{MAIN_BRANCH}`
     - Delete the `#{release_branch}` branch after creating the backmerge PR
   PROMPT
   next unless skip_confirm || UI.confirm('Continue?')
 
+  # Update CDN build visibility from Internal to External
+  make_cdn_builds_public(version: version)
+
   # Publish the draft GitHub release
   publish_github_release(
     repository: GITHUB_REPO,
@@ -581,7 +585,8 @@ def distribute_builds(
       arch: build[:arch],
       build_type: build_type,
       install_type: build[:install_type],
-      visibility: 'external',
+      visibility: :external,
+      post_status: release_tag&.match?(/beta/i) ? nil : 'draft',
       version: version,
       build_number: build_number,
       release_notes: release_notes,
@@ -819,6 +824,41 @@ def create_draft_github_release(version:, release_tag:, builds:)
   UI.success("Created draft GitHub release #{release_tag} with download links")
 end
 
+# Publish CDN builds by changing their post status from draft to publish.
+#
+# Queries the Apps CDN API to find draft builds matching the version,
+# then calls {update_apps_cdn_build_metadata} for each to set status to publish.
+# This is idempotent: if no drafts are found (already published), it logs a warning and returns.
+#
+# @param version [String] The version to publish (e.g., '1.7.5')
+#
+def make_cdn_builds_public(version:)
+  release_version = "v#{version}"
+  builds = list_apps_cdn_builds(
+    site_id: WPCOM_STUDIO_SITE_ID,
+    version: release_version,
+    post_status: 'draft'
+  )
+
+  if builds.empty?
+    UI.important("No draft CDN builds found for #{release_version}. They may have already been published.")
+    return
+  end
+
+  UI.message("Publishing #{builds.size} CDN build(s) for #{release_version}...")
+
+  builds.each do |build|
+    UI.message("  Publishing #{build[:title]} (post #{build[:post_id]})...")
+    update_apps_cdn_build_metadata(
+      site_id: WPCOM_STUDIO_SITE_ID,
+      post_id: build[:post_id],
+      post_status: 'publish'
+    )
+  end
+
+  UI.success('All CDN builds are now published')
+end
+
 # Trigger a release build in Buildkite for the given version.
 #
 # Uses `buildkite_add_trigger_step` on CI (to create a separate build with proper Git mirroring)