diff --git a/.github/workflows/publish-catalog.yml b/.github/workflows/publish-catalog.yml
index 2cf03ff..aca1fca 100644
--- a/.github/workflows/publish-catalog.yml
+++ b/.github/workflows/publish-catalog.yml
@@ -37,8 +37,18 @@ jobs:
             [[ "$GITHUB_REF" == "refs/heads/main" ]] || { echo "Dispatch this publisher from main." >&2; exit 1; }
             pr_number="$INPUT_PR_NUMBER"
           else
-            prs="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls")"
-            pr_number="$(jq -r '[.[] | select(.merged_at != null and .base.ref == "main")] | if length == 1 then .[0].number else empty end' <<< "$prs")"
+            pr_number=""
+            for attempt in {1..12}; do
+              prs="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${GITHUB_SHA}/pulls")"
+              pr_number="$(jq -r '[.[] | select(.merged_at != null and .base.ref == "main")] | if length == 1 then .[0].number else empty end' <<< "$prs")"
+              if [[ "$pr_number" =~ ^[0-9]+$ ]]; then
+                break
+              fi
+              echo "GitHub has not associated this main commit with its merged pull request yet (attempt $attempt/12)." >&2
+              if [[ "$attempt" -lt 12 ]]; then
+                sleep 5
+              fi
+            done
           fi
           [[ "$pr_number" =~ ^[0-9]+$ ]] || { echo "Could not identify exactly one merged bot submission pull request." >&2; exit 1; }
           pr="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${pr_number}")"
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
index 31b206c..5186f71 100644
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -16,4 +16,4 @@ After a bot pull request is merged, the publisher runs on a push to `main` that
 
 For publication to work, GitHub Actions must be enabled and the repository or organization policy must permit these token scopes. The repository's **Settings → Actions → General → Workflow permissions** should allow read and write permissions for `GITHUB_TOKEN` (currently enabled for this repository); the workflow itself still grants only the scopes listed above. If `main` is protected by branch rules, allow `github-actions[bot]` to push the generated catalog files, or publishing will fail. Recheck these settings if organization policy or branch rules change.
 
-GitHub may hold a fork contributor's validation run for approval by a maintainer with write access. The publisher does not need `pull_request_target` or a privileged fork workflow. To recover a merged submission whose publication failed, a maintainer can run **Publish bot catalog** from the `main` branch with its merged pull-request number. The dispatch verifies that it merged into `main` and that its head commit has a successful `validate` check before it regenerates the catalog using the PR author's account as owner.
+GitHub may hold a fork contributor's validation run for approval by a maintainer with write access. The publisher does not need `pull_request_target` or a privileged fork workflow. On a `main` push, it retries the commit-to-PR lookup for up to 55 seconds to allow GitHub to publish the association. To recover a merged submission whose publication still failed, a maintainer can run **Publish bot catalog** from the `main` branch with its merged pull-request number. The dispatch verifies that it merged into `main` and that its head commit has a successful `validate` check before it regenerates the catalog using the PR author's account as owner.