diff --git a/.github/workflows/release-email.yml b/.github/workflows/release-email.yml
index f47ad9ac..267e2aae 100644
--- a/.github/workflows/release-email.yml
+++ b/.github/workflows/release-email.yml
@@ -4,14 +4,23 @@ on:
   push:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release version (X.Y.Z) to send"
+        required: true
+      previous_version:
+        description: "Previous tag (X.Y.Z) for bump check; omit for first tag"
+        required: false
 
 concurrency:
-  group: release-email-${{ github.ref }}
+  group: release-email-${{ github.event_name == 'workflow_dispatch' && format('manual-{0}', inputs.version) || github.ref }}
   cancel-in-progress: false
 
 jobs:
   send:
     runs-on: ubuntu-latest
+    environment: production
     steps:
       - uses: actions/checkout@v4
         with:
@@ -27,22 +36,34 @@ jobs:
       - name: Install
         run: pnpm install --frozen-lockfile
 
-      - name: Resolve semver tags
+      - name: Resolve release version
         id: tags
+        env:
+          DISPATCH_VERSION: ${{ inputs.version }}
+          DISPATCH_PREVIOUS_VERSION: ${{ inputs.previous_version }}
         run: |
-          CURRENT="${GITHUB_REF_NAME#v}"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            CURRENT="$DISPATCH_VERSION"
+            PREVIOUS="$DISPATCH_PREVIOUS_VERSION"
+          else
+            CURRENT="${GITHUB_REF_NAME#v}"
+            if ! [[ "$CURRENT" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "Invalid release tag: ${GITHUB_REF_NAME}" >&2
+              exit 1
+            fi
+            PREVIOUS=$(git tag -l "v*.*.*" --merged HEAD --sort=-version:refname \
+              | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
+              | grep -v "^${GITHUB_REF_NAME}$" \
+              | head -1 \
+              | sed 's/^v//')
+          fi
           if ! [[ "$CURRENT" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Invalid release tag: ${GITHUB_REF_NAME}" >&2
+            echo "Invalid release version: ${CURRENT}" >&2
             exit 1
           fi
-          PREVIOUS=$(git tag -l "v*.*.*" --merged HEAD --sort=-version:refname \
-            | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
-            | grep -v "^${GITHUB_REF_NAME}$" \
-            | head -1 \
-            | sed 's/^v//')
           echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
           echo "previous=$PREVIOUS" >> "$GITHUB_OUTPUT"
-          echo "Tag ${GITHUB_REF_NAME} (previous on this line: ${PREVIOUS:-none})"
+          echo "Release ${CURRENT} (previous: ${PREVIOUS:-none})"
 
       - name: Check minor/major bump
         id: bump
diff --git a/docs/MARKETING-EMAIL.md b/docs/MARKETING-EMAIL.md
index c37c094b..1343cc22 100644
--- a/docs/MARKETING-EMAIL.md
+++ b/docs/MARKETING-EMAIL.md
@@ -68,6 +68,8 @@ Required GitHub repository secrets (production):
 | `TELEMETRY_EMAIL_FROM` | From address |
 | `TELEMETRY_DASHBOARD_ORIGIN` | Unsubscribe / docs links (e.g. `https://telemetry-tracker.com`) |
 
+Store these in the GitHub **`production`** environment (the workflow job uses `environment: production`). To retry a send without re-tagging, use **Actions → Release product email → Run workflow** with `version` and `previous_version`.
+
 The workflow runs **after** the tag is pushed — finalize `CHANGELOG.md` on `main` **before** tagging so the email body matches the release.
 
 ### Manual send (override / backfill)