diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..1e43bb1
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,45 @@
+---
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: 2026 The Linux Foundation
+
+# Thin caller for the reusable release workflow in generic-workflows.
+#
+# Replaces the former "fat" tag-push.yaml, which carried its own copy of
+# the validate-then-promote job graph. The reusable validates the pushed
+# tag against the organisation's release-gating policy, ensures a draft
+# release exists for the tag (creating one if release-drafter has not),
+# and then publishes it.
+#
+# No `with:` block: this repository adopts the reusable's defaults in
+# full. That covers the release-gating policy and also the runner
+# hardening defaults (egress policy and its allow-list). See the
+# generic-workflows README for every input and its default.
+name: 'Release on Tag Push 🚀'
+
+# yamllint disable-line rule:truthy
+on:
+  push:
+    tags:
+      - '**'
+
+permissions: {}
+
+# Serialise repeated runs for the same tag; never cancel an in-flight
+# release promotion. Distinct tags use distinct groups and proceed
+# independently. This group cannot collide with the reusable's own,
+# which carries a literal workflow-specific prefix.
+concurrency:
+  group: '${{ github.workflow }}-${{ github.ref }}'
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: 'Release'
+    # Deleting a tag also fires this push event. The reusable skips its
+    # own jobs on a deletion, but guarding here too keeps the previous
+    # behaviour exactly: no run starts at all.
+    if: "!github.event.deleted"
+    permissions:
+      contents: write  # Promote (publish) the draft release for the tag
+    # yamllint disable-line rule:line-length
+    uses: lfreleng-actions/generic-workflows/.github/workflows/release.yaml@007258a132e4ba5358a20a5c0a902fa04de3a045  # v0.0.4
diff --git a/.github/workflows/tag-push.yaml b/.github/workflows/tag-push.yaml
deleted file mode 100644
index 6052dc7..0000000
--- a/.github/workflows/tag-push.yaml
+++ /dev/null
@@ -1,105 +0,0 @@
----
-# SPDX-License-Identifier: Apache-2.0
-# SPDX-FileCopyrightText: 2025 The Linux Foundation
-
-# Runs on tag push, validates and promotes draft release
-name: 'Release on Tag Push 🚀'
-
-# yamllint disable-line rule:truthy
-on:
-  push:
-    tags:
-      - '**'
-
-permissions: {}
-
-# Serialise repeated runs for the same tag; never cancel an in-flight
-# release promotion. Distinct tags use distinct groups and proceed
-# independently.
-concurrency:
-  group: '${{ github.workflow }}-${{ github.ref }}'
-  cancel-in-progress: false
-
-jobs:
-  validate_tag:
-    name: 'Validate Tag'
-    # Skip tag deletion events
-    if: "!github.event.deleted"
-    runs-on: 'ubuntu-latest'
-    permissions:
-      contents: read
-    timeout-minutes: 5
-    outputs:
-      tag: "${{ steps.tag_validate.outputs.tag_name }}"
-    steps:
-      # Load the egress allow-list out-of-band from the
-      # organisation's .github repository and publish it as
-      # $CONNECTION_ALLOW_LIST for the harden-runner step below.
-      # yamllint disable-line rule:line-length
-      - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d  # v0.2.1
-        with:
-          config: '@bf6642f68d58c1b81bbe993e676d6cc339ac3654'  # v0.12.2
-
-      # Harden the runner with the just-loaded allow-list.
-      - name: 'Harden runner (block)'
-        # yamllint disable-line rule:line-length
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
-        with:
-          egress-policy: 'block'
-          allowed-endpoints: >
-            ${{ env.CONNECTION_ALLOW_LIST }}
-
-      # yamllint disable-line rule:line-length
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: 'Verify pushed tag'
-        id: tag_validate
-        # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/tag-validate-action@b2865c287f732486e12dfdfb75aef0692b024608  # v1.1.2
-        with:
-          token: "${{ secrets.GITHUB_TOKEN }}"
-          require_type: 'semver'
-          reject_development: 'true'
-          require_github: 'true'
-          # yamllint disable-line rule:line-length
-          require_signed: 'ssh,gpg-unverifiable'  # Cannot verify GPG without key
-
-  promote_release:
-    name: 'Promote Draft Release'
-    needs: validate_tag
-    runs-on: 'ubuntu-latest'
-    permissions:
-      contents: write  # Promote (publish) the draft release for the tag
-    timeout-minutes: 5
-    steps:
-      # Load the egress allow-list out-of-band from the
-      # organisation's .github repository and publish it as
-      # $CONNECTION_ALLOW_LIST for the harden-runner step below.
-      # yamllint disable-line rule:line-length
-      - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d  # v0.2.1
-        with:
-          config: '@bf6642f68d58c1b81bbe993e676d6cc339ac3654'  # v0.12.2
-
-      # Harden the runner with the just-loaded allow-list.
-      - name: 'Harden runner (block)'
-        # yamllint disable-line rule:line-length
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
-        with:
-          egress-policy: 'block'
-          allowed-endpoints: >
-            ${{ env.CONNECTION_ALLOW_LIST }}
-
-      # yamllint disable-line rule:line-length
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: 'Promote draft release'
-        # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/draft-release-promote-action@072990900b99030363d81d4131c2bf2855f07df0  # v0.1.4
-        with:
-          token: "${{ secrets.GITHUB_TOKEN }}"
-          tag: "${{ needs.validate_tag.outputs.tag }}"
-          latest: true