diff --git a/buildscripts/ci/release/collate_release_binaries.sh b/buildscripts/ci/release/collate_release_binaries.sh
index 61fb48fb31..4092fd19f7 100755
--- a/buildscripts/ci/release/collate_release_binaries.sh
+++ b/buildscripts/ci/release/collate_release_binaries.sh
@@ -27,20 +27,27 @@ set -euo pipefail # exit on error, error on unset variable, preserve errors in p
 
 ARTIFACTS_DIR=build.artifacts
 RELEASE_DIR=release
-CHECKSUMS_FILE=checksums.sha256.txt
+CHECKSUMS_FILE="${CHECKSUMS_FILE-checksums.sha256.txt}" # parameter: the name of the checksums file in the release
 
 mkdir "${RELEASE_DIR}" # error if it already exists (need it to be empty)
 
-# Move artifacts into release directory.
+# Move artifacts into release directory. artifact_name.env holds one file name per
+# line: usually one, but a build may produce several packages (e.g. an installer
+# and an archive on Windows).
+package_files=() # every file named there; each must have a checksum from its build
 for path in "${ARTIFACTS_DIR}/"*"/env/artifact_name.env"; do
     artifact_dir="$(dirname "$(dirname "${path}")")"
-    artifact_name="$(<"${path}")"
-    artifact_path="${artifact_dir}/${artifact_name}"
+    while IFS= read -r artifact_name || [[ "${artifact_name}" ]]; do
+        artifact_name="${artifact_name%$'\r'}"
+        [[ "${artifact_name}" ]] || continue
+        artifact_path="${artifact_dir}/${artifact_name}"
+        package_files+=("${artifact_name}")
 
-    mv -v "${artifact_path}" "${RELEASE_DIR}/"
-    if [[ -f "${artifact_path}.zsync" ]]; then
-        mv -v "${artifact_path}.zsync" "${RELEASE_DIR}/"
-    fi
+        mv -v "${artifact_path}" "${RELEASE_DIR}/"
+        if [[ -f "${artifact_path}.zsync" ]]; then
+            mv -v "${artifact_path}.zsync" "${RELEASE_DIR}/"
+        fi
+    done <"${path}"
 done
 
 declare -A old_checksums new_checksums # associative arrays (i.e. maps / dictionaries)
@@ -63,6 +70,14 @@ for path in "${ARTIFACTS_DIR}/"*"/checksum.txt"; do
     done <"${path}"
 done
 
+# A package file without a build checksum cannot be verified, so it must not be released.
+for filename in "${package_files[@]}"; do
+    if [[ -z "${old_checksums["${filename}"]+set}" ]]; then
+        echo >&2 "$o: Error: No build checksum for: ${filename}"
+        exit 1
+    fi
+done
+
 # Calculate new checksums to be uploaded with the release.
 echo >&2
 cd "${RELEASE_DIR}/"
diff --git a/buildscripts/ci/release/make_tag_name.sh b/buildscripts/ci/release/make_tag_name.sh
index 0e6ad1087d..0c3d6478ce 100755
--- a/buildscripts/ci/release/make_tag_name.sh
+++ b/buildscripts/ci/release/make_tag_name.sh
@@ -25,6 +25,15 @@ o="$(basename "$0")" # script name
 
 set -euo pipefail # exit on error, error on unset variable, preserve errors in pipelines
 
+# Inputs, as environment variables:
+#   RELEASE_TYPE  alpha, beta, rc or stable; any label when CREATE_TAG is not 'true'
+#   CREATE_TAG    'true' when a tag and a release will be made from the result
+# Parameters, as environment variables (the defaults are MuseScore's):
+TAG_PREFIX="${TAG_PREFIX-v}" # tag = <prefix><version>[-<label>], e.g. 'v4.0.0' or 'Audacity-4.0.0'
+TAG_LABEL_SEPARATOR="${TAG_LABEL_SEPARATOR-.}" # between a pre-release type and its number, e.g. 'rc.2' or 'beta-2'
+APP_DISPLAY_NAME="${APP_DISPLAY_NAME-MuseScore Studio}" # release name = '<app> <version> <label>'
+STABLE_RELEASE_LABEL="${STABLE_RELEASE_LABEL-Release}" # the <label> of a stable release; may be empty
+
 function tag_exists()
 {
     local tags="$(git tag --list -- "$@")"
@@ -41,7 +50,7 @@ function version_exists()
     local suffix="${label:+-${label}}" # prepend hyphen if label not empty
     version="${version%.0}" # strip patch number if it's zero
     version="${version%.0}" # strip minor number if it's zero
-    tag_exists "v${version}${suffix}" "v${version}.0${suffix}" "v${version}.0.0${suffix}"
+    tag_exists "${TAG_PREFIX}${version}${suffix}" "${TAG_PREFIX}${version}.0${suffix}" "${TAG_PREFIX}${version}.0.0${suffix}"
 }
 
 if [[ "${CREATE_TAG}" == 'true' ]]; then
@@ -62,7 +71,9 @@ else
     fi
 fi
 
-VERSION="$(cmake -P version.cmake | sed -n "s|^-- MUSE_APP_VERSION ||p")"
+version_info="$(cmake -P version.cmake)"
+VERSION="$(sed -n "s|^-- MUSE_APP_VERSION ||p" <<<"${version_info}")"
+VERSION_CMAKE_LABEL="$(sed -n "s|^-- MUSE_APP_VERSION_LABEL ||p" <<<"${version_info}")" # printed only by apps that name the pre-release in version.cmake
 int="(0|[1-9][0-9]*)"
 
 if [[ ! "${VERSION}" =~ ^${int}\.${int}\.${int}$ ]]; then
@@ -72,16 +83,16 @@ elif version_exists "${VERSION}"; then
     if [[ "${RELEASE_TYPE}" == 'stable' ]]; then
         echo >&2 "$o: Error: Stable tag already exists for version ${VERSION}."
     else
-        echo >&2 "$o: Error: Creating pre-release for v${VERSION}, which already has a stable tag."
+        echo >&2 "$o: Error: Creating pre-release for ${TAG_PREFIX}${VERSION}, which already has a stable tag."
     fi
     echo >&2 "You need to bump the version numbers in version.cmake (e.g. increase PATCH by 1)."
     exit 1
 elif [[ "${RELEASE_TYPE}" =~ ^(beta|alpha)$ ]] && version_exists "${VERSION}" 'rc*'; then
-    echo >&2 "$o: Error: Release type is '${RELEASE_TYPE}' but v${VERSION} already has a Release Candidate tag."
+    echo >&2 "$o: Error: Release type is '${RELEASE_TYPE}' but ${TAG_PREFIX}${VERSION} already has a Release Candidate tag."
     echo >&2 "Please change the release type to 'rc' or bump the version numbers in version.cmake."
     exit 1
 elif [[ "${RELEASE_TYPE}" == 'alpha' ]] && version_exists "${VERSION}" 'beta*'; then
-    echo >&2 "$o: Error: Release type is '${RELEASE_TYPE}' but v${VERSION} already has a Beta tag."
+    echo >&2 "$o: Error: Release type is '${RELEASE_TYPE}' but ${TAG_PREFIX}${VERSION} already has a Beta tag."
     echo >&2 "Please change the release type to 'beta' or 'rc', or bump the version numbers in version.cmake."
     exit 1
 fi
@@ -111,13 +122,36 @@ fi
 
 RELEASE_TYPE_COUNT=1
 
-if [[ "${RELEASE_TYPE}" == 'stable' ]]; then
+if [[ "${CREATE_TAG}" == 'true' && "${VERSION_CMAKE_LABEL}" ]]; then
+    # version.cmake names the pre-release itself (the app shows that label, and the
+    # package files may carry it), so the tag follows it instead of counting tags.
+    # The label is '<type>' or '<type><separator><number>', with <type> = RELEASE_TYPE.
+    if [[ "${RELEASE_TYPE}" == 'stable' ]]; then
+        echo >&2 "$o: Error: Release type is 'stable' but version.cmake has the pre-release label '${VERSION_CMAKE_LABEL}'."
+        echo >&2 "Clear MUSE_APP_VERSION_LABEL in version.cmake for a stable release."
+        exit 1
+    elif [[ ! "${VERSION_CMAKE_LABEL}" =~ ^${RELEASE_TYPE}([.-]?([1-9][0-9]*))?$ ]]; then
+        echo >&2 "$o: Error: Release type is '${RELEASE_TYPE}' but version.cmake has the pre-release label '${VERSION_CMAKE_LABEL}'."
+        echo >&2 "Expected '${RELEASE_TYPE}' or '${RELEASE_TYPE}.<number>' in MUSE_APP_VERSION_LABEL, or change the release type."
+        exit 1
+    fi
+    VERSION_LABEL="${RELEASE_TYPE}"
+    if [[ "${BASH_REMATCH[2]-}" ]]; then
+        RELEASE_TYPE_COUNT="${BASH_REMATCH[2]}"
+        VERSION_LABEL="${VERSION_LABEL}${TAG_LABEL_SEPARATOR}${RELEASE_TYPE_COUNT}"
+    fi
+    if version_exists "${VERSION}" "${VERSION_LABEL}"; then
+        echo >&2 "$o: Error: A tag already exists for ${TAG_PREFIX}${VERSION}-${VERSION_LABEL}."
+        echo >&2 "You need to bump the number in MUSE_APP_VERSION_LABEL in version.cmake."
+        exit 1
+    fi
+elif [[ "${RELEASE_TYPE}" == 'stable' ]]; then
     VERSION_LABEL=""
 else
     label="${RELEASE_TYPE}"
-    if version_exists "${VERSION}" "${label}" || version_exists "${VERSION}" "${label}.1"; then
+    if version_exists "${VERSION}" "${label}" || version_exists "${VERSION}" "${label}${TAG_LABEL_SEPARATOR}1"; then
         while true; do
-            label="${RELEASE_TYPE}.$((++RELEASE_TYPE_COUNT))"
+            label="${RELEASE_TYPE}${TAG_LABEL_SEPARATOR}$((++RELEASE_TYPE_COUNT))"
             version_exists "${VERSION}" "${label}" || break
         done
     fi
@@ -125,7 +159,7 @@ else
 fi
 
 PRETTY_VERSION="${MAJOR}.${MINOR}.${PATCH}"     # e.g. '4.0.0'
-TAG_NAME="v${PRETTY_VERSION}"                   # e.g. 'v4.0.0'
+TAG_NAME="${TAG_PREFIX}${PRETTY_VERSION}"       # e.g. 'v4.0.0'
 
 if [[ "${VERSION_LABEL}" ]]; then
     TAG_NAME="${TAG_NAME}-${VERSION_LABEL}"     # e.g. 'v4.0.0-rc.2'
@@ -138,7 +172,7 @@ if tag_exists "${TAG_NAME}"; then
 fi
 
 case "${RELEASE_TYPE}" in
-stable) PRETTY_RELEASE_TYPE="Release";;
+stable) PRETTY_RELEASE_TYPE="${STABLE_RELEASE_LABEL}";;
 rc)     PRETTY_RELEASE_TYPE="Release Candidate";;
 beta)   PRETTY_RELEASE_TYPE="Beta";;
 alpha)  PRETTY_RELEASE_TYPE="Alpha";;
@@ -151,5 +185,11 @@ if ((RELEASE_TYPE_COUNT > 1)); then
     RELEASE_LABEL="${RELEASE_LABEL} ${RELEASE_TYPE_COUNT}"
 fi
 
+RELEASE_NAME="${APP_DISPLAY_NAME} ${PRETTY_VERSION}"
+
+if [[ "${RELEASE_LABEL}" ]]; then
+    RELEASE_NAME="${RELEASE_NAME} ${RELEASE_LABEL}"     # e.g. 'MuseScore Studio 4.0.0 Release Candidate 2'
+fi
+
 echo "TAG_NAME=${TAG_NAME}"
-echo "RELEASE_NAME=MuseScore Studio ${PRETTY_VERSION} ${RELEASE_LABEL}"
+echo "RELEASE_NAME=${RELEASE_NAME}"
diff --git a/buildscripts/ci/release/push_file_to_s3.sh b/buildscripts/ci/release/push_file_to_s3.sh
index 8d6ae6f7d9..ce4fc43d7a 100644
--- a/buildscripts/ci/release/push_file_to_s3.sh
+++ b/buildscripts/ci/release/push_file_to_s3.sh
@@ -28,6 +28,9 @@ S3_BUCKET=""
 
 FILE_NAME=""
 
+# A bucket with ACLs disabled rejects --acl-public; public read then comes from the bucket policy.
+ACL_ARGS=(--acl-public)
+
 while [[ "$#" -gt 0 ]]; do
     case $1 in
         --s3_key) S3_KEY="$2"; shift ;;
@@ -35,6 +38,7 @@ while [[ "$#" -gt 0 ]]; do
         --s3_url) S3_URL="$2"; shift ;;
         --s3_bucket) S3_BUCKET="$2"; shift ;;
         --file_name) FILE_NAME="$2"; shift ;;
+        --no_acl_public) ACL_ARGS=() ;;
         *) echo "Unknown parameter passed: $1"; exit 1 ;;
     esac
     shift
@@ -61,4 +65,4 @@ EOL
 
 echo "=== Publish to S3 ==="
 
-s3cmd put --acl-public --guess-mime-type "$ARTIFACTS_DIR/$FILE_NAME" "$S3_URL"
+s3cmd put "${ACL_ARGS[@]}" --guess-mime-type "$ARTIFACTS_DIR/$FILE_NAME" "$S3_URL"
diff --git a/buildscripts/ci/tools/checksum.sh b/buildscripts/ci/tools/checksum.sh
index ce8634b7ca..c8a6c7a233 100755
--- a/buildscripts/ci/tools/checksum.sh
+++ b/buildscripts/ci/tools/checksum.sh
@@ -30,14 +30,19 @@ while [[ "$#" -gt 0 ]]; do
     shift
 done
 
-if [ -z "$ARTIFACT_PATH" ]; then 
-    ARTIFACT_NAME="$(cat $ARTIFACTS_DIR/env/artifact_name.env)";
-    if [ -z "$ARTIFACT_NAME" ]; then echo "error: not set ARTIFACT_NAME"; exit 1; fi
-    ARTIFACT_PATH=$ARTIFACTS_DIR/$ARTIFACT_NAME
+ARTIFACT_PATHS=()
+if [ -z "$ARTIFACT_PATH" ]; then
+    # artifact_name.env holds one file name per line: usually one, but a build may
+    # produce several packages (e.g. an installer and an archive on Windows).
+    while IFS= read -r ARTIFACT_NAME || [ -n "$ARTIFACT_NAME" ]; do
+        ARTIFACT_NAME="${ARTIFACT_NAME%$'\r'}"
+        if [ -n "$ARTIFACT_NAME" ]; then ARTIFACT_PATHS+=("$ARTIFACTS_DIR/$ARTIFACT_NAME"); fi
+    done < "$ARTIFACTS_DIR/env/artifact_name.env"
+    if [ ${#ARTIFACT_PATHS[@]} -eq 0 ]; then echo "error: not set ARTIFACT_NAME"; exit 1; fi
+else
+    ARTIFACT_PATHS=("$ARTIFACT_PATH")
 fi
 
-if [ -z "$ARTIFACT_PATH" ]; then echo "error: not set ARTIFACT_PATH"; exit 1; fi
+echo "ARTIFACT_PATH: ${ARTIFACT_PATHS[*]}"
 
-echo "ARTIFACT_PATH: $ARTIFACT_PATH"
-
-openssl sha256 $ARTIFACT_PATH > $ARTIFACTS_DIR/checksum.txt
\ No newline at end of file
+openssl sha256 "${ARTIFACT_PATHS[@]}" > $ARTIFACTS_DIR/checksum.txt
\ No newline at end of file