diff --git a/.mokogitea/workflows/pre-release.yml b/.mokogitea/workflows/pre-release.yml
index 36b73ae..01959e2 100644
--- a/.mokogitea/workflows/pre-release.yml
+++ b/.mokogitea/workflows/pre-release.yml
@@ -292,32 +292,17 @@ jobs:
 
           DOWNLOAD_URL="${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/download/${TAG}/${ZIP_NAME}"
 
-          # Use PHP to update the channel in updates.xml
-          php -r '
-            $xml_tag = $argv[1];
-            $version = $argv[2];
-            $sha256 = $argv[3];
-            $url = $argv[4];
-            $date = date("Y-m-d");
-
-            $content = file_get_contents("updates.xml");
-            $pattern = "/(<update>(?:(?!<\/update>).)*?<tag>" . preg_quote($xml_tag) . "<\/tag>.*?<\/update>)/s";
-
-            $content = preg_replace_callback($pattern, function($m) use ($version, $sha256, $url, $date) {
-              $block = $m[0];
-              $block = preg_replace("/<version>[^<]*<\/version>/", "<version>{$version}</version>", $block);
-              if (strpos($block, "<sha256>") !== false) {
-                $block = preg_replace("/<sha256>[^<]*<\/sha256>/", "<sha256>{$sha256}</sha256>", $block);
-              } else {
-                $block = str_replace("</downloads>", "</downloads>\n    <sha256>{$sha256}</sha256>", $block);
-              }
-              $block = preg_replace("/(<downloadurl[^>]*>)[^<]*(<\/downloadurl>)/", "\${1}{$url}\${2}", $block);
-              return $block;
-            }, $content);
-
-            file_put_contents("updates.xml", $content);
-            echo "Updated {$xml_tag} channel: version={$version}\n";
-          ' "$XML_TAG" "$VERSION" "$SHA256" "$DOWNLOAD_URL"
+          # Use moko-platform CLI to build/update updates.xml (preserves other channels)
+          MOKO_CLI="/tmp/moko-platform-api/cli"
+          if [ -f "${MOKO_CLI}/updates_xml_build.php" ]; then
+            php "${MOKO_CLI}/updates_xml_build.php" \
+              --path . --version "${VERSION}" --stability "${STABILITY}" \
+              --sha "${SHA256}" \
+              --gitea-url "${GITEA_URL}" --org "${GITEA_ORG}" --repo "${GITEA_REPO}"
+            echo "Updated ${STABILITY} channel via CLI: version=${VERSION}"
+          else
+            echo "WARNING: updates_xml_build.php not found — skipping"
+          fi
 
           # Commit and push
           if ! git diff --quiet updates.xml 2>/dev/null; then
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6816fc7..ebe4d9e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,9 +41,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Install API endpoint: extract ZIP to temp directory before passing to Joomla Installer (was passing ZIP path directly)
 - Clean up extracted temp directory on success or failure
+- Update site disabled by Joomla when protected=1 — ensureProtectedFlag() now re-enables it
 
 ### Changed
 - CI: auto-release uses stream tag `stable` instead of version tag `vXX`
+- CI: pre-release package build uses absolute paths (fixes relative path zip error)
 
 ## [02.05.00] - 2026-05-24
 
diff --git a/README.md b/README.md
index 8ee752c..5f88f88 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@
  DEFGROUP: Joomla.Plugin
  INGROUP: MokoWaaS
  REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoWaaS
- VERSION: 02.06.03
+ VERSION: 02.05.05
  PATH: /README.md
  BRIEF: MokoWaaS platform plugin for Joomla
 -->
diff --git a/src/packages/plg_system_mokowaas/Extension/MokoWaaS.php b/src/packages/plg_system_mokowaas/Extension/MokoWaaS.php
index 698bb8b..eb5f2c3 100644
--- a/src/packages/plg_system_mokowaas/Extension/MokoWaaS.php
+++ b/src/packages/plg_system_mokowaas/Extension/MokoWaaS.php
@@ -1067,6 +1067,8 @@ class MokoWaaS extends CMSPlugin
 		try
 		{
 			$db = Factory::getDbo();
+
+			// Set protected=1, locked=0 on MokoWaaS extensions
 			$query = $db->getQuery(true)
 				->update($db->quoteName('#__extensions'))
 				->set($db->quoteName('protected') . ' = 1')
@@ -1076,6 +1078,18 @@ class MokoWaaS extends CMSPlugin
 				->where($db->quoteName('protected') . ' = 0');
 			$db->setQuery($query);
 			$db->execute();
+
+			// Ensure update site stays enabled (protected extensions get their update site disabled by Joomla)
+			$query = $db->getQuery(true)
+				->update($db->quoteName('#__update_sites') . ' AS us')
+				->join('INNER', $db->quoteName('#__update_sites_extensions') . ' AS use2 ON us.update_site_id = use2.update_site_id')
+				->join('INNER', $db->quoteName('#__extensions') . ' AS e ON use2.extension_id = e.extension_id')
+				->set('us.enabled = 1')
+				->where('us.enabled = 0')
+				->where('(' . $db->quoteName('e.element') . ' = ' . $db->quote('mokowaas')
+					. ' OR ' . $db->quoteName('e.element') . ' = ' . $db->quote('pkg_mokowaas') . ')');
+			$db->setQuery($query);
+			$db->execute();
 		}
 		catch (\Throwable $e)
 		{