diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 97b6bfd..5df8799 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,8 +11,9 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Tag to build and publish (for example v1.0.1)"
-        required: true
+        description: "Tag to build and publish; leave empty to use the latest tag"
+        required: false
+        default: ""
         type: string
 
 permissions:
@@ -48,7 +49,10 @@ jobs:
     if: github.server_url == 'https://github.com'
     runs-on: ubuntu-latest
     steps:
+      # Full history and tags: a manual run resolves the tag with git describe.
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - uses: actions/setup-go@v5
         with:
@@ -58,11 +62,20 @@ jobs:
       - name: Resolve tag
         id: tag
         env:
-          DISPATCH_TAG: ${{ inputs.tag }}
-          PUSHED_TAG: ${{ github.ref_name }}
+          INPUT_TAG: ${{ inputs.tag }}
+          REF_NAME: ${{ github.ref_name }}
+          EVENT_NAME: ${{ github.event_name }}
         run: |
           set -euo pipefail
-          tag="${DISPATCH_TAG:-$PUSHED_TAG}"
+          tag="${INPUT_TAG:-}"
+          if [ -z "$tag" ]; then
+            if [ "$EVENT_NAME" = "push" ]; then
+              tag="$REF_NAME"
+            else
+              tag="$(git describe --tags --abbrev=0)"
+            fi
+          fi
+          [ -n "$tag" ] || { echo "no tag found, pass one explicitly" >&2; exit 1; }
           echo "value=$tag" >> "$GITHUB_OUTPUT"
           echo "building $tag"