diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 894ace7..12215e8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,20 +1,61 @@
 name: Publish
 
 on:
-  release:
-    types: [published]
+  workflow_run:
+    workflows: ["Release Please"]
+    types: [completed]
   workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to publish (e.g. mattermind-v0.1.0)"
+        required: true
 
 permissions:
+  contents: read
   id-token: write   # Trusted Publisher (PyPI OIDC)
 
 jobs:
+  check:
+    name: Check release tag
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.head_branch == 'master')
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.workflow_run.head_sha }}
+          fetch-tags: true
+
+      - name: Resolve tag
+        id: tag
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            TAG=$(git tag --points-at HEAD | grep -E '^mattermind-v' | head -1)
+            echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+            if [ -z "$TAG" ]; then
+              echo "No release tag on this commit — skipping publish."
+            else
+              echo "Will publish $TAG"
+            fi
+          fi
+
   publish:
     name: Build and publish to PyPI
+    needs: check
+    if: needs.check.outputs.tag != ''
     runs-on: ubuntu-latest
     environment: pypi
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.check.outputs.tag }}
+
       - uses: astral-sh/setup-uv@v7
       - run: uv build
       - run: uv publish
diff --git a/.gitignore b/.gitignore
index 734fec4..a9c65d6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -128,3 +128,6 @@ dmypy.json
 
 # Pyre type checker
 .pyre/
+
+# Claude Code worktrees
+.claude/worktrees/
diff --git a/release-please-config.json b/release-please-config.json
index 95c670a..6c3e713 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -8,7 +8,8 @@
       "extra-files": [
         {
           "type": "generic",
-          "path": "src/mattermind/__version__.py"
+          "path": "src/mattermind/__version__.py",
+          "search": "__version__ = \"$1\""
         }
       ]
     }