diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3b1d765..3c3f4c7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,6 +1,9 @@
 name: release
+run-name: release ${{ github.event.release.tag_name || format('v{0}', inputs.version) || github.ref_name }}
 
 on:
+  release:
+    types: [published]
   workflow_dispatch:
     inputs:
       version:
@@ -17,22 +20,17 @@ on:
         required: true
         default: false
         type: boolean
-  push:
-    tags: ["v*"]
-
 permissions:
-  contents: write
-  id-token: write
-  attestations: write
-  artifact-metadata: write
+  contents: read
 
 concurrency:
-  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.version || github.ref_name }}
+  group: release-${{ github.event.release.tag_name || format('v{0}', inputs.version) || github.ref_name }}
   cancel-in-progress: false
 
 jobs:
   prepare:
     runs-on: ubuntu-latest
+    permissions: {}
     outputs:
       version: ${{ steps.release.outputs.version }}
       tag: ${{ steps.release.outputs.tag }}
@@ -51,6 +49,11 @@ jobs:
             tag="v${version}"
             draft="${{ inputs.draft }}"
             prerelease="${{ inputs.prerelease }}"
+          elif [[ "${{ github.event_name }}" == "release" ]]; then
+            tag="${{ github.event.release.tag_name }}"
+            version="${tag#v}"
+            draft="${{ github.event.release.draft }}"
+            prerelease="${{ github.event.release.prerelease }}"
           else
             tag="${GITHUB_REF_NAME}"
             version="${tag#v}"
@@ -78,6 +81,11 @@ jobs:
     name: ${{ matrix.label }}
     needs: prepare
     runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     strategy:
       fail-fast: false
       matrix:
@@ -205,6 +213,8 @@ jobs:
     name: SHA256 checksums
     needs: [prepare, build]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Download release assets
         env:
diff --git a/README.md b/README.md
index 3b3654b..c8bc35b 100644
--- a/README.md
+++ b/README.md
@@ -78,8 +78,8 @@ task build     # release .app + .dmg in src-tauri/target/release/bundle/
 
 Release builds are created by `.github/workflows/release.yml`.
 
-- Manual release: GitHub Actions → **release** → Run workflow → enter a SemVer version without `v`, for example `0.1.0`. Leave `draft` unchecked to publish it immediately, or check it for a private review pass.
-- Tagged release: push a `v*` tag, for example `v0.1.0`.
+- Normal release: create and publish a GitHub Release with a `v*` tag, for example `v0.1.0`. Publishing the release triggers the cross-platform build and attaches the packages back to that release.
+- Manual repair path: GitHub Actions → **release** → Run workflow → enter a SemVer version without `v`, for example `0.1.0`. Leave `draft` unchecked to publish it immediately, or check it for a private review pass.
 - Packages built: macOS universal `.dmg`, Windows x64 NSIS installer, Windows ARM64 NSIS installer, Linux x64 `.AppImage`, and Linux x64 `.deb`.
 - `SHA256SUMS.txt` is attached to each release for package integrity checks, and GitHub provenance attestations are generated for the release packages.