diff --git a/.github/workflows/tag_on_main.yml b/.github/workflows/tag_on_main.yml
index 4fa3d1714..388a2b537 100644
--- a/.github/workflows/tag_on_main.yml
+++ b/.github/workflows/tag_on_main.yml
@@ -17,6 +17,10 @@ on:
   push:
     branches:
       - main
+  # Manual fallback: if the push-triggered run was ever skipped (e.g. a commit
+  # with [skip ci] landing on main), the tag can be created by dispatching this
+  # workflow against main. It is idempotent — it skips if the tag already exists.
+  workflow_dispatch:
 
 jobs:
   tag:
diff --git a/release.sh b/release.sh
index 3ba67c2fb..b5dee1d9d 100755
--- a/release.sh
+++ b/release.sh
@@ -104,7 +104,10 @@ echo_run git switch -c "$RELEASE_BRANCH"
 # --- bump version on the release branch ----
 sed -i '' "s/${MARKETING_KEY}[[:space:]]*=.*/${MARKETING_KEY} = ${new_ver}/" "$VERSION_FILE"
 echo_run git diff "$VERSION_FILE"; pause
-echo_run git commit -m "update version to ${new_ver} [skip ci]" "$VERSION_FILE"
+# No [skip ci] here on purpose: it would skip the required SwiftFormat lint check
+# (leaving the release PRs blocked) and the tag_on_main workflow (no auto-tag).
+# auto_version_dev already avoids re-bumping via its "Config.xcconfig changed" guard.
+echo_run git commit -m "update version to ${new_ver}" "$VERSION_FILE"
 
 echo "💻  Build & test release branch now."; pause
 queue_push push origin "$RELEASE_BRANCH"