diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 798b14a..1696f3c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,17 @@ on:
   push:
     tags:
       - "v*"
+  # tag-release (in validate.yml) pushes the tag using the default
+  # GITHUB_TOKEN, which GitHub does not allow to trigger other workflows
+  # (loop prevention), so it explicitly re-dispatches this workflow instead
+  # of relying on the push trigger above to fire. The tag input tells this
+  # run which tag to check out and release, since a workflow_dispatch run
+  # has no tag ref of its own to infer one from.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to release (e.g. v0.3.0)"
+        required: true
 
 permissions:
   contents: write
@@ -14,6 +25,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref_name }}
 
       - uses: actions/setup-node@v4
         with:
@@ -43,5 +56,6 @@ jobs:
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           files: release.tar.gz
           generate_release_notes: true
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 8aa927c..90661b9 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -33,6 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      actions: write
 
     steps:
       - uses: actions/checkout@v4
@@ -40,6 +41,8 @@ jobs:
           fetch-depth: 0
 
       - name: Tag plugin.json's version if untagged
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           VERSION=$(node -pe "JSON.parse(require('fs').readFileSync('plugin.json', 'utf8')).version")
           TAG="v${VERSION}"
@@ -53,3 +56,11 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git tag "$TAG"
           git push origin "$TAG"
+
+          # A tag pushed with the default GITHUB_TOKEN does not trigger
+          # other workflows' push:tags events (GitHub's loop-prevention),
+          # so explicitly dispatch release.yml instead of relying on the
+          # push trigger to fire. release.yml's workflow_dispatch only
+          # exists on main, not on the tag itself, so dispatch against
+          # main and pass the tag as an input for it to check out.
+          gh workflow run release.yml --repo "${{ github.repository }}" -f tag="$TAG"