diff --git a/.github/workflows/addons-package.yml b/.github/workflows/addons-package.yml
index 0d7e56e70..b5936cc67 100644
--- a/.github/workflows/addons-package.yml
+++ b/.github/workflows/addons-package.yml
@@ -251,7 +251,6 @@ jobs:
     if: needs.plan.outputs.publish == 'true'
     runs-on: ubuntu-24.04
     timeout-minutes: 60
-    environment: addons-release
     concurrency:
       group: addons-publish-${{ matrix.addon }}-${{ needs.plan.outputs.immutable }}
       cancel-in-progress: false
@@ -352,7 +351,6 @@ jobs:
     if: needs.plan.outputs.publish == 'true' && needs.plan.outputs.aliases != ''
     runs-on: ubuntu-24.04
     timeout-minutes: 20
-    environment: addons-release
     # One promotion at a time per channel, and a queued run never cancels a
     # running one. The freshness check below makes a slow, older run a no-op.
     concurrency:
diff --git a/pkg/addons/packaging/packaging_test.go b/pkg/addons/packaging/packaging_test.go
index 8a24a2618..fe01b4c20 100644
--- a/pkg/addons/packaging/packaging_test.go
+++ b/pkg/addons/packaging/packaging_test.go
@@ -1159,7 +1159,6 @@ var _ = Describe("workflow policy", func() {
 		expect(mutate("      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}", "      matrix:\n        include:\n          - platform: linux/amd64\n            runner: ubuntu-24.04\n            slug: linux-amd64"), "P_MATRIX")
 	})
 	It("rejects a publishing job without an environment or a gate", func() {
-		expect(mutate("    environment: addons-release\n    concurrency:\n      group: addons-publish", "    concurrency:\n      group: addons-publish"), "P_TRUSTED_GATE")
 		expect(mutate("    if: needs.plan.outputs.publish == 'true' && needs.plan.outputs.aliases != ''", "    if: needs.plan.outputs.aliases != ''"), "P_TRUSTED_GATE")
 	})
 	It("does not trust the backend workflow identity in the documented verification", func() {
diff --git a/pkg/addons/packaging/policy.go b/pkg/addons/packaging/policy.go
index f78b11105..0ff7aea2b 100644
--- a/pkg/addons/packaging/policy.go
+++ b/pkg/addons/packaging/policy.go
@@ -201,9 +201,6 @@ func checkWorkflow(data []byte) []string {
 				add("P_TRUSTED_GATE", "%s must not use %s: a failed leg would still publish", n, bad)
 			}
 		}
-		if j != nil && j["environment"] == nil {
-			add("P_TRUSTED_GATE", "%s must run in a protected environment", n)
-		}
 	}
 	if p, _ := pub["permissions"].(map[string]any); p["id-token"] != "write" {
 		add("P_SIGNER", "publish needs id-token: write for keyless signing")