diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ee8f1fd..9b37bd2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,13 +2,11 @@ name: Release
 
 # Manual "ship it" signal. CI (ci.yml) stays the per-PR/per-push correctness gate;
 # this workflow is triggered by hand from the Actions tab when you want to release.
+#
+# The version is NOT entered here — package.json is the single source of truth. Bump it
+# in a normal reviewed PR (`npm version <x.y.z> --no-git-tag-version`), then dispatch this.
 on:
   workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version tag to release, e.g. v0.2.0. Leave blank to deploy without tagging.'
-        required: false
-        type: string
 
 # Least privilege by default; each job widens only what it needs.
 permissions:
@@ -59,11 +57,12 @@ jobs:
       - id: deployment
         uses: actions/deploy-pages@v4
 
-  # Only when a version was supplied: tag the released commit and cut a GitHub Release.
+  # Tag the released commit and cut a GitHub Release. The version comes from package.json
+  # (the source of truth), so the tag can never drift from the declared version. Idempotent:
+  # re-dispatching against an existing version skips cleanly instead of erroring.
   tag-and-release:
     name: Tag & GitHub Release
     needs: deploy
-    if: ${{ inputs.version != '' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -73,9 +72,18 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release create "${{ inputs.version }}" \
+          VER="v$(node -p "require('./package.json').version")"
+          if ! [[ "$VER" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "package.json version '$VER' is not a valid release tag (vX.Y.Z)." >&2
+            exit 1
+          fi
+          if gh release view "$VER" >/dev/null 2>&1; then
+            echo "Release $VER already exists — skipping. Bump package.json to cut a new one."
+            exit 0
+          fi
+          gh release create "$VER" \
             --target "${{ github.sha }}" \
-            --title "${{ inputs.version }}" \
+            --title "$VER" \
             --generate-notes
 
   # Promote the released state to the production branch (main) via a PR — a human merges
@@ -94,8 +102,9 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
-          VERSION: ${{ inputs.version }}
         run: |
+          VERSION="v$(node -p "require('./package.json').version")"
+
           ahead=$(gh api "repos/$REPO/compare/main...develop" --jq '.ahead_by')
           if [ "$ahead" -eq 0 ]; then
             echo "main is already up to date with develop — no release PR needed."
@@ -108,11 +117,7 @@ jobs:
             exit 0
           fi
 
-          if [ -n "$VERSION" ]; then
-            title="Release $VERSION: develop -> main"
-          else
-            title="Release: develop -> main"
-          fi
+          title="Release $VERSION: develop -> main"
           gh pr create --repo "$REPO" \
             --base main --head develop \
             --title "$title" \
diff --git a/package.json b/package.json
index 31d6f0f..4431fed 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "map-explorer",
   "private": true,
-  "version": "0.1.0",
+  "version": "1.0.0",
   "type": "module",
   "description": "Portale di ricerca per dati ESA via STAC (Copernicus Data Space)",
   "scripts": {