diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 24a9f98..7a32dc0 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -3,6 +3,12 @@ name: release
 on:
   push:
     tags: ["v*.*.*"]
+  # A release that dies halfway -- the runner OOMs, the host reboots -- leaves
+  # the tag pushed and nothing published, and re-pushing a tag to retry it is
+  # both awkward and destructive. Dispatch re-runs the same release instead.
+  # goreleaser refuses to run unless the checked-out commit is itself tagged,
+  # so this can only ever republish a real tag, never main-in-progress.
+  workflow_dispatch: {}
 
 env:
   GO_VERSION: "1.25.x"
@@ -66,6 +72,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: pulumi-dokploy
+          # Needed for the tag lookup below.
+          fetch-depth: 0
 
       - uses: actions/checkout@v4
         with:
@@ -92,8 +100,14 @@ jobs:
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}
 
+      # On a tag push the ref name is the tag; on a dispatch it is the branch,
+      # so ask git what tag this commit carries. --exact-match keeps a dispatch
+      # from quietly publishing an untagged commit under the previous version.
       - name: Derive version from tag
-        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
+        working-directory: pulumi-dokploy
+        run: |
+          TAG="$(git describe --tags --exact-match)"
+          echo "VERSION=${TAG#v}" >> "$GITHUB_ENV"
 
       - name: Build SDKs
         working-directory: pulumi-dokploy