diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 6bb2ba0..88ae17b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -1,9 +1,8 @@
 name: Release
 
 on:
-  push:
-    tags:
-      - "v*"
+  release:
+    types: [published]
 
 permissions:
   contents: write
@@ -24,7 +23,7 @@ jobs:
       - name: Verify tag is on main
         run: |
           git fetch origin main
-          tag_commit="$(git rev-list -n 1 "$GITHUB_REF_NAME")"
+          tag_commit="$(git rev-list -n 1 "${{ github.event.release.tag_name }}")"
           git merge-base --is-ancestor "$tag_commit" origin/main
 
       - run: rustup toolchain install
@@ -33,21 +32,24 @@ jobs:
 
       - name: Build static binary
         run: |
+          TAG="${{ github.event.release.tag_name }}"
           cargo build --release --target x86_64-unknown-linux-musl --locked
           mkdir -p dist
-          cp target/x86_64-unknown-linux-musl/release/guestd "dist/guestd-${GITHUB_REF_NAME}-x86_64-linux-musl"
-          chmod +x "dist/guestd-${GITHUB_REF_NAME}-x86_64-linux-musl"
+          cp target/x86_64-unknown-linux-musl/release/guestd "dist/guestd-${TAG}-x86_64-linux-musl"
+          chmod +x "dist/guestd-${TAG}-x86_64-linux-musl"
 
       - name: Build rootfs EROFS image
         run: |
+          TAG="${{ github.event.release.tag_name }}"
           ./scripts/build-rootfs.sh \
             target/x86_64-unknown-linux-musl/release/guestd \
-            "dist/rootfs-${GITHUB_REF_NAME}-x86_64.erofs"
+            "dist/rootfs-${TAG}-x86_64.erofs"
 
       - name: Upload release artifacts
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          binary="dist/guestd-${GITHUB_REF_NAME}-x86_64-linux-musl"
-          rootfs="dist/rootfs-${GITHUB_REF_NAME}-x86_64.erofs"
-          gh release upload "$GITHUB_REF_NAME" "$binary" "$rootfs" --clobber
+          TAG="${{ github.event.release.tag_name }}"
+          binary="dist/guestd-${TAG}-x86_64-linux-musl"
+          rootfs="dist/rootfs-${TAG}-x86_64.erofs"
+          gh release upload "$TAG" "$binary" "$rootfs" --clobber