diff --git a/.github/workflows/cyberpunkunicorn-os.yml b/.github/workflows/cyberpunkunicorn-os.yml
index 201ae49..0c1a1a0 100644
--- a/.github/workflows/cyberpunkunicorn-os.yml
+++ b/.github/workflows/cyberpunkunicorn-os.yml
@@ -3,6 +3,8 @@ name: "cyberpunkunicorn-os: build and release"
 # Path-filtered: touching another project must not run this.
 # A tag cu5k-v<version> (matching OS_VERSION in build.sh) publishes a GitHub
 # release with app.bin + manifest.json, which the website's updater reads.
+# "Run workflow" on main with release ticked does the same without pushing a tag
+# by hand: the release step creates cu5k-v<OS_VERSION> on the built commit.
 on:
   push:
     paths: ["cyberpunkunicorn-os/**", ".github/workflows/cyberpunkunicorn-os.yml"]
@@ -10,6 +12,11 @@ on:
   pull_request:
     paths: ["cyberpunkunicorn-os/**", ".github/workflows/cyberpunkunicorn-os.yml"]
   workflow_dispatch:
+    inputs:
+      release:
+        description: "Publish cu5k-v<OS_VERSION> from this commit"
+        type: boolean
+        default: false
 
 concurrency:
   group: cu5k-${{ github.ref }}
@@ -59,7 +66,7 @@ jobs:
           if-no-files-found: error
 
   release:
-    if: startsWith(github.ref, 'refs/tags/cu5k-v')
+    if: startsWith(github.ref, 'refs/tags/cu5k-v') || (github.event_name == 'workflow_dispatch' && inputs.release && github.ref == 'refs/heads/main')
     needs: build
     runs-on: ubuntu-latest
     permissions:
@@ -71,20 +78,27 @@ jobs:
           path: dist
 
       - name: Tag must match the build's version
+        id: tag
         run: |
           version=$(python3 -c 'import json; print(json.load(open("dist/manifest.json"))["version"])')
-          test "${GITHUB_REF_NAME}" = "cu5k-v${version}" || {
-            echo "Tag ${GITHUB_REF_NAME} but build.sh says OS_VERSION=${version}"; exit 1; }
+          tag="cu5k-v${version}"
+          if [ "${GITHUB_REF_TYPE}" = "tag" ] && [ "${GITHUB_REF_NAME}" != "$tag" ]; then
+            echo "Tag ${GITHUB_REF_NAME} but build.sh says OS_VERSION=${version}"; exit 1
+          fi
+          echo "name=$tag" >> "$GITHUB_OUTPUT"
 
       # Bruce is AGPL-3.0: the release links its own source (this tag) and keeps
       # the "Based on Bruce" credit, which the firmware shows in Device Info.
       - uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ steps.tag.outputs.name }}
+          target_commitish: ${{ github.sha }}
+          name: CyberUnicorn 5000 ${{ steps.tag.outputs.name }}
           files: |
             dist/app.bin
             dist/full.bin
             dist/manifest.json
           body: |
-            CyberUnicorn 5000 ${{ github.ref_name }}. Based on Bruce (AGPL-3.0); source is this tag.
+            CyberUnicorn 5000 ${{ steps.tag.outputs.name }}. Based on Bruce (AGPL-3.0); source is this tag.
             Update from the website, or `./flash.sh` with `app.bin` (keeps settings).
             `full.bin` is the whole flash image for a first install only.
diff --git a/cyberpunkunicorn-os/CLAUDE.md b/cyberpunkunicorn-os/CLAUDE.md
index def97b6..be772d0 100644
--- a/cyberpunkunicorn-os/CLAUDE.md
+++ b/cyberpunkunicorn-os/CLAUDE.md
@@ -15,7 +15,9 @@ build (copied, not shared — that project stays as the known-good fallback).
   app.bin size + sha256, offset 0x10000: what the website's updater reads)
 - CI: `.github/workflows/cyberpunkunicorn-os.yml` builds every push/PR touching this folder
   and fails if app.bin outgrows the 0x3C0000 app partition. Tag `cu5k-v<OS_VERSION>`
-  to publish a GitHub release with app.bin, full.bin and manifest.json
+  to publish a GitHub release with app.bin, full.bin and manifest.json (or Actions → Run workflow
+  on main with "release" ticked, which creates that tag itself: this cloud environment
+  can't push tags)
 - Flash: `./flash.sh` (app only, keeps on-device settings) or `./flash.sh --full`
 - Remote: `./remote.sh` mirrors the screen to http://localhost:8765 over serial
 - Test: none automated. A clean build is the minimum bar; confirm on the device