diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..ef1be5a
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,57 @@
+name: Publish
+
+# Publishes an existing GitHub release to the VS Code Marketplace and Open VSX.
+# It ships the exact .vsix attached to the release, after checking its sha256,
+# so a store listing always matches an accepted, tagged build.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to publish, for example v0.3.0
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    env:
+      TAG: ${{ inputs.tag }}
+      VSCE_PAT: ${{ secrets.VSCE_PAT }}
+      OVSX_PAT: ${{ secrets.OVSX_PAT }}
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Download and verify the release package
+        id: vsix
+        run: |
+          VSIX="sf-vscode-${TAG#v}.vsix"
+          gh release download "$TAG" --pattern "$VSIX" --pattern "$VSIX.sha256"
+          sha256sum -c "$VSIX.sha256"
+          echo "path=$VSIX" >> "$GITHUB_OUTPUT"
+          echo "publisher=$(node -p "require('./package.json').publisher")" >> "$GITHUB_OUTPUT"
+      - name: Require at least one store token
+        if: env.VSCE_PAT == '' && env.OVSX_PAT == ''
+        run: |
+          echo "::error::Neither VSCE_PAT nor OVSX_PAT is set."
+          exit 1
+      - name: Publish to the VS Code Marketplace
+        if: env.VSCE_PAT != ''
+        run: npx --yes @vscode/vsce@3.2.2 publish --packagePath "${{ steps.vsix.outputs.path }}" --pat "$VSCE_PAT"
+      - name: Ensure the Open VSX namespace
+        if: env.OVSX_PAT != ''
+        run: |
+          out=$(npx --yes ovsx@1.3.0 create-namespace "${{ steps.vsix.outputs.publisher }}" --pat "$OVSX_PAT" 2>&1) && echo "$out" || {
+            echo "$out"
+            echo "$out" | grep -qi 'already exists' || exit 1
+          }
+      - name: Publish to Open VSX
+        if: env.OVSX_PAT != ''
+        run: npx --yes ovsx@1.3.0 publish "${{ steps.vsix.outputs.path }}" --pat "$OVSX_PAT"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b341524..a739e79 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -122,6 +122,16 @@ Publishing happens only after the owner accepts a release.
 4. It publishes to the VS Code Marketplace only when the `VSCE_PAT` secret is
    set, and to Open VSX only when `OVSX_PAT` is set; otherwise it skips the
    step with a notice. The Marketplace publisher is `SIMAI`.
+5. To publish a release that already exists on GitHub (for example after the
+   store tokens were added), run `.github/workflows/publish.yml` by hand:
+
+   ```sh
+   gh workflow run publish.yml -R simai/ui-vscode -f tag=v0.3.0
+   ```
+
+   It downloads the release `.vsix`, checks it against the attached sha256,
+   creates the Open VSX namespace if it is missing, and publishes that exact
+   file. Nothing is rebuilt.
 
 ## Versioning