diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3b1949a..e3a983a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,6 +3,11 @@ name: Release
 on:
   push:
     tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Source tag to release
+        required: true
 
 permissions:
   contents: read
@@ -18,18 +23,25 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          # Empty on a tag push, where the triggering ref is already the tag.
+          # Dispatched runs are privileged, so the input can only name a tag,
+          # never a branch or a pull request.
+          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || '' }}
           fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+      - if: github.event_name == 'push'
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - if: github.event_name == 'push'
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Generate GitHub App token
+        if: github.event_name == 'push'
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
@@ -43,15 +55,22 @@ jobs:
       - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           version: "~> v2"
-          args: release --clean
+          # A dispatched run only needs dist/ populated so the npm packages can
+          # be assembled from it, so it rebuilds the tag's binaries and archives
+          # nothing. Those binaries won't be byte-identical to the ones already
+          # released - go.mod asks for Go 1.26, so setup-go resolves whatever
+          # patch is current - which is why nothing else is republished here.
+          args: ${{ github.event_name == 'workflow_dispatch' && 'build --clean' || 'release --clean' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
       # Attests every file listed in the checksum file.
-      - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+      - if: github.event_name == 'push'
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-checksums: ./dist/checksums.txt
-      - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+      - if: github.event_name == 'push'
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-checksums: ./dist/digests.txt
 
@@ -59,13 +78,15 @@ jobs:
         with:
           node-version: 24 # npm >= 11.5.1 required for OIDC trusted publishing
       # TODO: switch to goreleaser-npm-publisher-action once https://github.com/evg4b/goreleaser-npm-publisher/pull/26 is released
-      # Prebuilt dist committed on the fork branch (5e09f1e + dist/, built and
-      # smoke-tested locally). Deliberately no yarn install/build here: this job
-      # holds id-token: write, so third-party install scripts must not run in it.
+      # Prebuilt dist committed on the fork branch
       - name: Fetch goreleaser-npm-publisher
         run: |
           git clone https://github.com/khvn26/goreleaser-npm-publisher "$RUNNER_TEMP/gnp"
           git -C "$RUNNER_TEMP/gnp" checkout ad16d393106b23b6289d0569beefb8e9b3bd3159
+      - name: Install goreleaser-npm-publisher runtime dependencies
+        working-directory: ${{ runner.temp }}/gnp
+        # set --mode=skip-build to block third-party install/postinstall scripts
+        run: corepack yarn install --immutable --mode=skip-build
       - name: Publish npm packages
         run: >-
           node "$RUNNER_TEMP/gnp/dist/cli.cjs" publish
@@ -78,16 +99,10 @@ jobs:
           --keywords flagsmith feature-flags cli
           --files README.md LICENSE
 
-      # During public beta the newest beta is what people
-      # should land on, so clear it.
-      - if: contains(github.ref_name, '-beta')
-        run: gh release edit "$GITHUB_REF_NAME" --prerelease=false --latest
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
   install-script:
     name: install.sh (${{ matrix.os }})
     needs: goreleaser
+    if: github.event_name == 'push'
     strategy:
       fail-fast: false
       matrix:
@@ -103,6 +118,7 @@ jobs:
   install-script-windows:
     name: install.ps1
     needs: goreleaser
+    if: github.event_name == 'push'
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1