diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 98898b6172..af026a6057 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -137,11 +137,19 @@ jobs:
             commit_sha="${RELEASE_COMMIT}"
             echo "Reusing existing release commit ${commit_sha}"
           else
-            make_blob() {
-              jq -nc --arg content "$(base64 -w0 <"$1")" \
+            # Stage the base64 in a temp file and feed it to jq via
+            # --rawfile: passing big blobs (the PGO profile is ~2 MB encoded)
+            # through --arg exceeds ARG_MAX on the runner. Subshell body +
+            # EXIT trap clean up the tmpfile even if base64/jq/gh aborts.
+            make_blob() (
+              local tmp
+              tmp=$(mktemp)
+              trap 'rm -f "$tmp"' EXIT
+              base64 -w0 <"$1" >"$tmp"
+              jq -nc --rawfile content "$tmp" \
                 '{content: $content, encoding: "base64"}' \
                 | gh api "repos/${REPO}/git/blobs" --input - -q .sha
-            }
+            )
 
             parent_sha=$(gh api "repos/${REPO}/git/refs/heads/main" -q .object.sha)
             base_tree=$(gh api "repos/${REPO}/git/commits/${parent_sha}" -q .tree.sha)