diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 7933c256..59bbfd72 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -15,6 +15,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       github.event.workflow_run.conclusion == 'success'
     permissions:
+      actions: read
       contents: write
       pull-requests: write
 
@@ -33,6 +34,34 @@ jobs:
       - name: Install dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
 
+      - name: Download native addon from Publish
+        if: github.event_name == 'workflow_run'
+        uses: actions/download-artifact@v4
+        with:
+          name: native-linux-x64
+          path: ${{ runner.temp }}/native-artifact
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Install native addon from Publish
+        if: github.event_name == 'workflow_run'
+        run: |
+          ARTIFACT_DIR="${{ runner.temp }}/native-artifact"
+          NODE_FILE="$ARTIFACT_DIR/codegraph-core.node"
+          if [ ! -f "$NODE_FILE" ]; then
+            echo "::error::Native addon not found at $NODE_FILE"
+            ls -la "$ARTIFACT_DIR" || true
+            exit 1
+          fi
+          PKG_DIR="node_modules/@optave/codegraph-linux-x64-gnu"
+          mkdir -p "$PKG_DIR"
+          cp "$NODE_FILE" "$PKG_DIR/codegraph-core.node"
+          if [ ! -f "$PKG_DIR/package.json" ]; then
+            echo '{"name":"@optave/codegraph-linux-x64-gnu","main":"codegraph-core.node"}' > "$PKG_DIR/package.json"
+          fi
+          echo "Installed native addon from Publish workflow run ${{ github.event.workflow_run.id }}"
+          echo "  sha256: $(sha256sum "$PKG_DIR/codegraph-core.node" | cut -d' ' -f1)"
+
       - name: Run build benchmark
         run: node scripts/benchmark.js 2>/dev/null > benchmark-result.json
 
@@ -85,6 +114,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       github.event.workflow_run.conclusion == 'success'
     permissions:
+      actions: read
       contents: write
       pull-requests: write
 
@@ -103,6 +133,34 @@ jobs:
       - name: Install dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
 
+      - name: Download native addon from Publish
+        if: github.event_name == 'workflow_run'
+        uses: actions/download-artifact@v4
+        with:
+          name: native-linux-x64
+          path: ${{ runner.temp }}/native-artifact
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Install native addon from Publish
+        if: github.event_name == 'workflow_run'
+        run: |
+          ARTIFACT_DIR="${{ runner.temp }}/native-artifact"
+          NODE_FILE="$ARTIFACT_DIR/codegraph-core.node"
+          if [ ! -f "$NODE_FILE" ]; then
+            echo "::error::Native addon not found at $NODE_FILE"
+            ls -la "$ARTIFACT_DIR" || true
+            exit 1
+          fi
+          PKG_DIR="node_modules/@optave/codegraph-linux-x64-gnu"
+          mkdir -p "$PKG_DIR"
+          cp "$NODE_FILE" "$PKG_DIR/codegraph-core.node"
+          if [ ! -f "$PKG_DIR/package.json" ]; then
+            echo '{"name":"@optave/codegraph-linux-x64-gnu","main":"codegraph-core.node"}' > "$PKG_DIR/package.json"
+          fi
+          echo "Installed native addon from Publish workflow run ${{ github.event.workflow_run.id }}"
+          echo "  sha256: $(sha256sum "$PKG_DIR/codegraph-core.node" | cut -d' ' -f1)"
+
       - name: Cache HuggingFace models
         uses: actions/cache@v4
         with:
@@ -167,6 +225,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       github.event.workflow_run.conclusion == 'success'
     permissions:
+      actions: read
       contents: write
       pull-requests: write
 
@@ -185,6 +244,34 @@ jobs:
       - name: Install dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
 
+      - name: Download native addon from Publish
+        if: github.event_name == 'workflow_run'
+        uses: actions/download-artifact@v4
+        with:
+          name: native-linux-x64
+          path: ${{ runner.temp }}/native-artifact
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Install native addon from Publish
+        if: github.event_name == 'workflow_run'
+        run: |
+          ARTIFACT_DIR="${{ runner.temp }}/native-artifact"
+          NODE_FILE="$ARTIFACT_DIR/codegraph-core.node"
+          if [ ! -f "$NODE_FILE" ]; then
+            echo "::error::Native addon not found at $NODE_FILE"
+            ls -la "$ARTIFACT_DIR" || true
+            exit 1
+          fi
+          PKG_DIR="node_modules/@optave/codegraph-linux-x64-gnu"
+          mkdir -p "$PKG_DIR"
+          cp "$NODE_FILE" "$PKG_DIR/codegraph-core.node"
+          if [ ! -f "$PKG_DIR/package.json" ]; then
+            echo '{"name":"@optave/codegraph-linux-x64-gnu","main":"codegraph-core.node"}' > "$PKG_DIR/package.json"
+          fi
+          echo "Installed native addon from Publish workflow run ${{ github.event.workflow_run.id }}"
+          echo "  sha256: $(sha256sum "$PKG_DIR/codegraph-core.node" | cut -d' ' -f1)"
+
       - name: Run query benchmark
         run: node scripts/query-benchmark.js 2>/dev/null > query-benchmark-result.json
 
@@ -237,6 +324,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       github.event.workflow_run.conclusion == 'success'
     permissions:
+      actions: read
       contents: write
       pull-requests: write
 
@@ -255,6 +343,34 @@ jobs:
       - name: Install dependencies
         run: npm ci --prefer-offline --no-audit --no-fund
 
+      - name: Download native addon from Publish
+        if: github.event_name == 'workflow_run'
+        uses: actions/download-artifact@v4
+        with:
+          name: native-linux-x64
+          path: ${{ runner.temp }}/native-artifact
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Install native addon from Publish
+        if: github.event_name == 'workflow_run'
+        run: |
+          ARTIFACT_DIR="${{ runner.temp }}/native-artifact"
+          NODE_FILE="$ARTIFACT_DIR/codegraph-core.node"
+          if [ ! -f "$NODE_FILE" ]; then
+            echo "::error::Native addon not found at $NODE_FILE"
+            ls -la "$ARTIFACT_DIR" || true
+            exit 1
+          fi
+          PKG_DIR="node_modules/@optave/codegraph-linux-x64-gnu"
+          mkdir -p "$PKG_DIR"
+          cp "$NODE_FILE" "$PKG_DIR/codegraph-core.node"
+          if [ ! -f "$PKG_DIR/package.json" ]; then
+            echo '{"name":"@optave/codegraph-linux-x64-gnu","main":"codegraph-core.node"}' > "$PKG_DIR/package.json"
+          fi
+          echo "Installed native addon from Publish workflow run ${{ github.event.workflow_run.id }}"
+          echo "  sha256: $(sha256sum "$PKG_DIR/codegraph-core.node" | cut -d' ' -f1)"
+
       - name: Run incremental benchmark
         run: node scripts/incremental-benchmark.js 2>/dev/null > incremental-benchmark-result.json