diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 109a2f27..c6a3f144 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,10 @@ name: Release
 on:
   # Can be triggered from the tag.yaml workflow
   workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
   # Or, developers can manually push a tag from their clone
   push:
     tags:
@@ -11,7 +15,8 @@ on:
 
 jobs:
   release:
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v5
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@e6faaa01d320a21515f1d9cc0618e8ceb04e8fbf # https://github.com/bazel-contrib/.github/pull/19
     with:
       prerelease: false
       release_files: rules_lint-*.tar.gz
+      tag_name: ${{ inputs.tag_name }}
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index 1e17563b..f49b7c16 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -3,6 +3,7 @@
 # It also runs on a schedule so we don't leave commits unreleased indefinitely
 # (avoiding users having to ping "hey could someone cut a release").
 
+name: Tag a Release
 on:
   # Allow devs to tag manually through the GitHub UI.
   # For example after landing a fix that customers are waiting for.
@@ -17,11 +18,11 @@ on:
 jobs:
   tag:
     permissions:
-      # create tag
-      contents: write
+      contents: write # allow create tag
     runs-on: ubuntu-latest
     outputs:
       new-tag: ${{ steps.ccv.outputs.new-tag }}
+      new-tag-version: ${{steps.ccv.outputs.new-tag-version}}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -33,4 +34,8 @@ jobs:
   release:
     needs: tag
     uses: ./.github/workflows/release.yml
+    with:
+      tag_name: ${{ needs.tag.outputs.new-tag-version }}
     if: needs.tag.outputs.new-tag == 'true'
+    permissions:
+      contents: write # allow create release
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6bb8e41e..007a3725 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -38,9 +38,20 @@ This means that any usage of `@rules_lint` on your system will point to this fol
 
 ## Releasing
 
-1. Determine the next release version, following semver (could automate in the future from changelog)
-1. Tag the repo and push it (or create a tag in GH UI)
-1. Watch the automation run on GitHub actions
+**Easiest**: if the new version can be determined automatically from the commit history, just navigate to
+https://github.com/aspect-build/rules_lint/actions/workflows/tag.yaml
+and press the "Run workflow" button.
+
+If you need control over the next release version, for example when making a release candidate for a new major,
+then: tag the repo and push the tag, for example
+
+```sh
+% git fetch
+% git tag v1.0.0-rc0 origin/main
+% git push origin v1.0.0-rc0
+```
+
+Then watch the automation run on GitHub actions which creates the release.
 
 ## Recording a demo