diff --git a/.github/workflows/Dockerfile b/.github/workflows/Dockerfile
index 843e50a..beba817 100644
--- a/.github/workflows/Dockerfile
+++ b/.github/workflows/Dockerfile
@@ -26,7 +26,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         git \
     && rm -rf /var/lib/apt/lists/*
 
-RUN python3 -m pip install --no-cache-dir "conan>=2"
+RUN python3 -m venv /opt/venv
+ENV PATH="/opt/venv/bin:${PATH}"
+RUN pip install --upgrade pip
+RUN pip install --no-cache-dir "conan>=2"
 
 RUN groupadd --gid ${GID} ${USERNAME} && \
     useradd --uid ${UID} --gid ${GID} -m ${USERNAME}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0d3ae49..d8587e3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,6 +34,9 @@ jobs:
         with:
           python-version: '3.x'
 
+      - name: Create Python virtual environment
+        run: python -m venv .venv
+
       - name: Build linux container image
         if: matrix.platform == 'linux'
         run: |
@@ -78,43 +81,10 @@ jobs:
       - name: Package release ZIP
         env:
           PLATFORM_NAME: ${{ matrix.platform }}
+        shell: bash
         run: |
-          python - <<'PY'
-          import os
-          import shutil
-          from pathlib import Path
-
-          root = Path.cwd()
-          release_dir = root / "release"
-          package_dir = release_dir / "package"
-          if package_dir.exists():
-              shutil.rmtree(package_dir)
-          package_dir.mkdir(parents=True)
-
-          platform_name = os.environ["PLATFORM_NAME"]
-          binary_name = "sdl3_app.exe" if platform_name == "windows" else "sdl3_app"
-          build_dir = root / os.environ["BUILD_DIR"]
-          if platform_name == "windows":
-              binary_source = build_dir / "Release" / binary_name
-          else:
-              binary_source = build_dir / binary_name
-          if not binary_source.exists():
-              raise SystemExit(f"Missing binary at {binary_source}")
-          shutil.copy2(binary_source, package_dir / binary_name)
-
-          for subdir in ("shaders", "scripts"):
-              src = build_dir / subdir
-              if not src.exists():
-                  raise SystemExit(f"Missing {subdir} directory at {src}")
-              shutil.copytree(src, package_dir / subdir)
-
-          shutil.copy2(root / "README.md", package_dir / "README.md")
-
-          zip_name = os.environ["ZIP_NAME"]
-          archive_path = release_dir / zip_name
-          shutil.make_archive(str(archive_path.with_suffix("")), "zip", root_dir=package_dir)
-          print(f"Created {archive_path}")
-          PY
+          . .venv/bin/activate
+          python scripts/package_release.py
 
       - name: Publish GitHub release asset
         if: github.ref != 'refs/tags/local'
diff --git a/scripts/package_release.py b/scripts/package_release.py
new file mode 100644
index 0000000..fcaca27
--- /dev/null
+++ b/scripts/package_release.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+import os
+import shutil
+from pathlib import Path
+
+root = Path.cwd()
+release_dir = root / "release"
+package_dir = release_dir / "package"
+if package_dir.exists():
+    shutil.rmtree(package_dir)
+package_dir.mkdir(parents=True)
+
+platform_name = os.environ["PLATFORM_NAME"]
+build_dir = root / os.environ["BUILD_DIR"]
+binary_name = "sdl3_app.exe" if platform_name == "windows" else "sdl3_app"
+if platform_name == "windows":
+    binary_source = build_dir / "Release" / binary_name
+else:
+    binary_source = build_dir / binary_name
+if not binary_source.exists():
+    raise SystemExit(f"Missing binary at {binary_source}")
+shutil.copy2(binary_source, package_dir / binary_name)
+
+for subdir in ("shaders", "scripts"):
+    src = build_dir / subdir
+    target = package_dir / subdir
+    if not src.exists():
+        raise SystemExit(f"Missing {subdir} directory at {src}")
+    shutil.copytree(src, target)
+
+shutil.copy2(root / "README.md", package_dir / "README.md")
+
+zip_name = os.environ["ZIP_NAME"]
+archive_path = release_dir / zip_name
+shutil.make_archive(str(archive_path.with_suffix("")), "zip", root_dir=package_dir)
+print(f"Created {archive_path}")