diff --git a/.github/workflows/release-cli.yml b/.github/workflows/release-cli.yml
index 68b7375..6edc4d3 100644
--- a/.github/workflows/release-cli.yml
+++ b/.github/workflows/release-cli.yml
@@ -9,6 +9,11 @@ name: Release CLI
 on:
   push:
     tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "tag to (re)publish, e.g. v2.12.1"
+        required: true
 
 permissions:
   contents: read
@@ -18,7 +23,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with: { fetch-depth: 0 }
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.inputs.tag || github.ref_name }}
       - uses: actions/setup-go@v5
         with: { go-version-file: go.mod }
       - uses: goreleaser/goreleaser-action@v6
@@ -55,4 +62,4 @@ jobs:
         run: |
           gh api "repos/${{ matrix.repo }}/dispatches" \
             -f event_type=kit-released \
-            -F "client_payload[version]=${GITHUB_REF_NAME}"
+            -F "client_payload[version]=${{ github.event.inputs.tag || github.ref_name }}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 48eb9f9..b919378 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,4 +29,4 @@ jobs:
           # A PAT (contents:write + pull-requests:write on this repo) lets the
           # action create the Version Packages PR even while the org forbids
           # Actions-created PRs; falls back to the Actions token otherwise.
-          GITHUB_TOKEN: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.KIT_RELEASE_TOKEN || secrets.GITHUB_TOKEN }}