"Invalid bundle ID for container" error when using multiple bundle identifiers for Debug and Release builds

Background:

• My app successfully uses CloudKit syncing, and syncing works reliably in general.
• I'm using multiple .xcconfig files to distinguish between Debug and Release builds. These define different PRODUCT_BUNDLE_IDENTIFIERs (e.g., com.myapp.debug and com.myapp.release).
• I use a single iCloud container for both builds.
• Since CloudKit separates Development and Production environments internally, using a single container for both builds should be fine.

Problem:

• In Debug, sync works flawlessly.
• After deploying the schema to Production via the CloudKit Console, I tried the Release build.
• But when running the Release build, I get this error:

<CKSyncEngine Shared> error saving subscriptions: <CKError 0x107f5bbd0: "Permission Failure" (10/2007);
server message = "Invalid bundle ID for container";
op = 3A7DC3820C2102AE;
uuid = AE35791F-97BD-4A3B-86F6-20EA7E164E71;
container ID = "redacted">

What I’ve tried:

• I verified that the iCloud container is selected for the Debug bundle ID in the Apple Developer Portal.
• I also went to Certificates, Identifiers & Profiles → Identifiers, selected the Release bundle ID, and ensured the correct iCloud container is checked there as well.
• I expected that to solve it—but unfortunately, it still does not work.

Questions:

• What exactly causes the "Invalid bundle ID for container" error (for the release build only)?
• Do I need to explicitly register both bundle IDs with the container in all relevant places?
• Is there another step I'm missing when using different bundle IDs with the same iCloud container?