diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 37a9b6b..ed01d06 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,8 +1,10 @@
 name: Release
 
+# Pushing a v* tag releases: the tag must match the project version and
+# point at a commit on main.
 on:
-  release:
-    types: [published]
+  push:
+    tags: ['v*']
   workflow_dispatch:
     inputs:
       version:
@@ -16,19 +18,20 @@ permissions:
 # Manual dry runs get their own group, so they can never displace a pending
 # release (GitHub keeps only one pending run per group).
 concurrency:
-  group: maven-central-${{ github.event_name == 'release' && 'release' || 'dry-run' }}
+  group: maven-central-${{ github.event_name == 'push' && 'release' || 'dry-run' }}
   cancel-in-progress: false
 
 jobs:
   validate:
-    if: github.event_name == 'release' && github.event.release.prerelease == false
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     steps:
-      # github.sha is the tag's commit when the release was published, so a
-      # tag moved while this workflow runs cannot swap in untested code.
+      # github.sha is the tag's commit when it was pushed, so a tag moved
+      # while this workflow runs cannot swap in untested code.
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.sha }}
+          fetch-depth: 0
       - uses: actions/setup-java@v5
         with:
           distribution: temurin
@@ -36,7 +39,7 @@ jobs:
           cache: maven
       - name: Validate release tag
         env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          RELEASE_TAG: ${{ github.ref_name }}
         run: |
           VERSION="$(./mvnw -q -N org.apache.maven.plugins:maven-help-plugin:3.5.2:evaluate -Dexpression=project.version -DforceStdout)"
           if [[ "$VERSION" == *-SNAPSHOT ]]; then
@@ -54,6 +57,11 @@ jobs:
             echo "::error::Tag $RELEASE_TAG now points at ${TAGGED:-nothing}, not the released commit $GITHUB_SHA"
             exit 1
           fi
+          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
+            echo "::error::Tag $RELEASE_TAG points at $GITHUB_SHA, which is not on main"
+            exit 1
+          fi
 
   build:
     needs: validate
@@ -65,8 +73,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      # github.sha is the tag's commit when the release was published, so a
-      # tag moved while this workflow runs cannot swap in untested code.
+      # github.sha is the tag's commit when it was pushed, so a tag moved
+      # while this workflow runs cannot swap in untested code.
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.sha }}