diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0d89866..292db34 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -284,3 +284,20 @@ jobs:
             --target main \
             --title "${{ steps.version.outputs.next }}" \
             --notes-file ./build/tmp/release_note.txt
+
+      # Signing and publishing happen here rather than in a workflow listening for the `release` event.
+      # GitHub deliberately does not start workflows from events raised with GITHUB_TOKEN, so the release
+      # created above never woke anything up: 2.0.0 was tagged with no assets and never reached the
+      # Marketplace. Doing it in the same job removes the indirection entirely.
+      - name: Publish to JetBrains Marketplace
+        env:
+          PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
+          CERTIFICATE_CHAIN: ${{ secrets.CERTIFICATE_CHAIN }}
+          PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}
+          PRIVATE_KEY_PASSWORD: ${{ secrets.PRIVATE_KEY_PASSWORD }}
+        run: ./gradlew publishPlugin
+
+      - name: Attach the plugin to the release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload "${{ steps.version.outputs.next }}" ./build/distributions/*
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b8643af..6ed65e9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,21 +1,30 @@
-# GitHub Actions Workflow created for handling the release process based on the draft release prepared with the Build workflow.
-# Running the publishPlugin task requires all the following secrets to be provided: PUBLISH_TOKEN, PRIVATE_KEY, PRIVATE_KEY_PASSWORD, CERTIFICATE_CHAIN.
-# See https://plugins.jetbrains.com/docs/intellij/plugin-signing.html for more information.
+# Manual publish of an existing tag to JetBrains Marketplace.
+#
+# The automated path lives in build.yml: its `release` job bumps the version, tags, and publishes in one
+# go. This workflow is the escape hatch for a tag that exists but was never published - which is exactly
+# how 2.0.0 ended up tagged with no assets, because GitHub does not start workflows from events raised
+# with GITHUB_TOKEN, so the old `on: release` trigger here never fired.
+#
+# Requires the same secrets as the automated path: PUBLISH_TOKEN, CERTIFICATE_CHAIN, PRIVATE_KEY,
+# PRIVATE_KEY_PASSWORD.
+
+name: Publish tag
 
-name: Release
 on:
-  release:
-    types: [prereleased, released]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to publish, e.g. 2.0.0'
+        required: true
+        type: string
 
 jobs:
 
-  # Prepare and publish the plugin to JetBrains Marketplace repository
-  release:
-    name: Publish Plugin
+  publish:
+    name: Publish to Marketplace
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      pull-requests: write
     steps:
 
       # Free GitHub Actions Environment Disk Space
@@ -25,30 +34,30 @@ jobs:
           tool-cache: false
           large-packages: false
 
-      # Check out the current repository
       - name: Fetch Sources
         uses: actions/checkout@v5
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ inputs.tag }}
 
-      # Set up the Java environment for the next steps
       - name: Setup Java
         uses: actions/setup-java@v5
         with:
           distribution: zulu
           java-version: 21
 
-      # Setup Gradle
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v5
-        with:
-          cache-read-only: true
 
-      # No changelog step here. The release job in build.yml patches and commits CHANGELOG.md before the
-      # release is created, so doing it again would duplicate the section - and the pull request this
-      # workflow used to open to carry that edit back is no longer needed either.
+      # Guards against publishing a build that does not match the tag it claims to be.
+      - name: Check the tag matches pluginVersion
+        run: |
+          VERSION=$(grep -E '^[[:space:]]*pluginVersion' gradle.properties | sed 's/^[^=]*=//' | tr -d '[:space:]')
+          if [ "$VERSION" != "${{ inputs.tag }}" ]; then
+            echo "Tag '${{ inputs.tag }}' does not match pluginVersion '$VERSION'"
+            exit 1
+          fi
+          echo "Publishing $VERSION"
 
-      # Publish the plugin to JetBrains Marketplace
       - name: Publish Plugin
         env:
           PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
@@ -57,8 +66,7 @@ jobs:
           PRIVATE_KEY_PASSWORD: ${{ secrets.PRIVATE_KEY_PASSWORD }}
         run: ./gradlew publishPlugin
 
-      # Upload an artifact as a release asset
-      - name: Upload Release Asset
+      - name: Attach the plugin to the release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload ${{ github.event.release.tag_name }} ./build/distributions/*
+        run: gh release upload "${{ inputs.tag }}" ./build/distributions/* --clobber