diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ce7e4c7c1584..d16c448c9aac 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,7 +1,7 @@
 name: Publish
 
 on:
-  workflow_dispatch:
+  # Publish canary on push
   push:
     branches:
       - main
@@ -9,15 +9,34 @@ on:
     paths:
       - .github/workflows/publish.yml
       - package.json
-      - packages/*
+      - packages/**
+
+  # Publish release on manual dispatch
+  workflow_dispatch:
+    inputs:
+      npm_version:
+        description: 'NPM Version - Including prerelease suffix (optional)'
+        required: true
+        default: 3.0.0-alpha.0
+      npm_tag:
+        type: choice
+        description: 'NPM Dist Tag - Use `latest` for official stable releases'
+        # default: canary
+        required: true
+        options:
+          - canary
+          - alpha
+          - beta
+          - rc
+          - latest
 
 permissions:
-  contents: read
   id-token: write # For OIDC, see https://docs.npmjs.com/trusted-publishers
+  contents: write # For GitHub tags
 
 jobs:
-  publish-canary:
-    name: Publish Canary
+  publish:
+    name: Publish NPM release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -34,16 +53,39 @@ jobs:
           # cache: yarn
       - name: Prepare git
         run: |
-          git config --global user.name "Docusaurus Canary"
-          git config --global user.email "canary@docusaurus.io"
+          git config --global user.name "Docusaurus"
+          git config --global user.email "github@docusaurus.io"
       - name: Installation
         run: yarn || yarn || yarn
         # TODO Docusaurus v4: remove after we upgrade the Node version
       - name: Upgrade Lerna
         run: |
           yarn add -D -W lerna@9.0.3 --ignore-scripts
-          git commit -am "chore: upgrade lerna"
+          git restore .
+
       - name: Publish Canary release
+        if: |
+          github.event_name == 'push' ||
+          (github.event_name == 'workflow_dispatch' && github.event.inputs.npm_tag == 'canary')
         run: |
           yarn canary:bumpVersion
           yarn canary:publish
+
+      - name: Publish NPM release
+        if: |
+          github.event_name == 'workflow_dispatch' && github.event.inputs.npm_tag != 'canary'
+        run: |
+          yarn lerna publish \
+            --force-publish \
+            --exact "${{ github.event.inputs.npm_version }}" \
+            --dist-tag "${{ github.event.inputs.npm_tag }}" \
+            --loglevel verbose \
+            --yes \
+            --no-verify-access \
+            --no-push
+          git push origin v"${{ github.event.inputs.npm_version }}"
+
+        # TODO Docusaurus v4: upgrade Lerna, remove useless --no-verify-access everywhere
+        # TODO should we push the package version local updates to Git?
+        #  "main" is currently protected, even GitHub Actions can't push to it
+        #  However it remains useful to push the git tag
diff --git a/package.json b/package.json
index 8f6ce6d52964..885b9fc25850 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "argos:build": "cross-env DOCUSAURUS_ARGOS_BUILD=true yarn build:website:fast --dev",
     "argos:screenshot": "yarn workspace argos screenshot",
     "canary": "yarn canary:bumpVersion && yarn canary:publish",
-    "canary:getCoreVersion": "node -p \"require('./packages/docusaurus/package.json').version\"",
+    "canary:getCoreVersion": "node -p \"require('./packages/docusaurus/package.json').version.split('-')[0]\"",
     "canary:version": "echo `yarn --silent canary:getCoreVersion`-canary-`git rev-list --count HEAD`+`git rev-parse --short HEAD`",
     "canary:bumpVersion": "yarn lerna version `yarn --silent canary:version` --exact --no-push --yes --loglevel verbose",
     "canary:publish": "yarn lerna publish from-package --dist-tag canary --yes --no-verify-access --loglevel verbose",
diff --git a/yarn.lock b/yarn.lock
index b32cd34cd000..5bb261c45de0 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9201,9 +9201,9 @@ flat@^5.0.2:
   integrity sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==
 
 flatted@^3.2.9, flatted@^3.3.1:
-  version "3.3.1"
-  resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.3.1.tgz#21db470729a6734d4997002f439cb308987f567a"
-  integrity sha512-X8cqMLLie7KsNUDSdzeN8FYK9rEt4Dt67OsG/DNGnYTSDBG4uFAJFBnUeiV+zCVAvwFy56IjM9sH51jVaEhNxw==
+  version "3.4.2"
+  resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.4.2.tgz#f5c23c107f0f37de8dbdf24f13722b3b98d52726"
+  integrity sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==
 
 follow-redirects@^1.0.0, follow-redirects@^1.15.6:
   version "1.15.9"