diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ff1494c..e7ff573 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,10 @@ on:
     tags:
       - "v*"
   workflow_dispatch:
+    inputs:
+      tag:
+        description: Tag to release, for example v1.2.3
+        required: false
 
 permissions:
   contents: write
@@ -16,6 +20,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.event.inputs.tag || github.ref }}
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 1038da6..120c8e1 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -17,6 +17,7 @@ on:
         required: false
 
 permissions:
+  actions: write
   contents: write
   issues: write
   pull-requests: write
@@ -51,23 +52,37 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
       - name: Create tag if missing
+        id: create_tag
         env:
           PUSH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
           TARGET_SHA: ${{ github.event.inputs.sha || github.event.pull_request.merge_commit_sha || github.sha }}
         run: |
           tag="v${{ steps.version.outputs.version }}"
+          created="false"
 
           git fetch --tags origin
           if git rev-parse "$tag" >/dev/null 2>&1; then
             echo "tag $tag already exists"
-            exit 0
+          else
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git remote set-url origin "https://x-access-token:${PUSH_TOKEN}@github.com/${{ github.repository }}.git"
+            git tag "$tag" "$TARGET_SHA"
+            git push origin "$tag"
+            created="true"
           fi
 
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git remote set-url origin "https://x-access-token:${PUSH_TOKEN}@github.com/${{ github.repository }}.git"
-          git tag "$tag" "$TARGET_SHA"
-          git push origin "$tag"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "created=$created" >> "$GITHUB_OUTPUT"
+
+      - name: Dispatch release workflow
+        if: steps.create_tag.outputs.created == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh workflow run release.yml \
+            --ref main \
+            -f tag="${{ steps.create_tag.outputs.tag }}"
 
       - name: Mark release PR as tagged
         if: github.event_name == 'pull_request_target' || github.event.inputs.pr_number != ''
diff --git a/docs/releasing.md b/docs/releasing.md
index 9f622bf..76f1cb7 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -11,7 +11,7 @@ This repo uses conventional commits on `main` plus `release-please` and
   parseable release commits.
 - `release-please` watches `main`, opens a release PR, updates `CHANGELOG.md`, and bumps the version manifest.
 - Merging the release PR triggers `tag-release`, which creates the Git tag from the merged release commit.
-- Tag pushes trigger `goreleaser`, which builds artifacts, creates the GitHub Release, and updates `hack-dance/homebrew-tap`.
+- `tag-release` then dispatches the `release` workflow for that tag so `goreleaser` builds artifacts, creates the GitHub Release, and updates `hack-dance/homebrew-tap`.
 
 ## Required secrets
 
@@ -27,7 +27,7 @@ This repo uses conventional commits on `main` plus `release-please` and
 3. Review the generated version and changelog.
 4. Merge the release PR.
 5. Verify `tag-release` pushed the expected `vX.Y.Z` tag.
-6. Verify the `release` workflow published artifacts and updated the Homebrew tap.
+6. Verify the dispatched `release` workflow published artifacts and updated the Homebrew tap.
 
 ## Local dry run