diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 64315b3..179ac7c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,13 +2,19 @@ name: Release Extension
 
 on:
   push:
+    branches:
+      - main
     tags:
       - 'v*'
+    paths:
+      - package.json
+      - extension/manifest.json
+      - .github/workflows/release.yml
   workflow_dispatch:
     inputs:
       version:
         description: 'Version to release (example: v1.2.3)'
-        required: true
+        required: false
         type: string
 
 permissions:
@@ -40,10 +46,20 @@ jobs:
         id: meta
         shell: bash
         run: |
+          PACKAGE_VERSION="$(node -p "JSON.parse(require('fs').readFileSync('package.json', 'utf8')).version")"
+          MANIFEST_VERSION="$(node -p "JSON.parse(require('fs').readFileSync('extension/manifest.json', 'utf8')).version")"
+
+          if [[ "$PACKAGE_VERSION" != "$MANIFEST_VERSION" ]]; then
+            echo "package.json version ($PACKAGE_VERSION) does not match extension/manifest.json version ($MANIFEST_VERSION)" >&2
+            exit 1
+          fi
+
           if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
             TAG="${GITHUB_REF_NAME}"
-          else
+          elif [[ -n "${{ inputs.version }}" ]]; then
             TAG="${{ inputs.version }}"
+          else
+            TAG="v${MANIFEST_VERSION}"
           fi
 
           if [[ ! "$TAG" =~ ^v ]]; then
@@ -79,6 +95,7 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.meta.outputs.tag }}
+          target_commitish: ${{ github.sha }}
           name: Vibe Code Detector ${{ steps.meta.outputs.version }}
           generate_release_notes: true
           body: |
diff --git a/README.md b/README.md
index 989a34a..8aa8461 100644
--- a/README.md
+++ b/README.md
@@ -83,10 +83,11 @@ npm run build    # Build the Chrome extension into extension/
 npm run lint     # Run ESLint
 ```
 
-CI runs on every push via GitHub Actions. Releases can be published either by:
+CI runs on every push via GitHub Actions. Releases can be published by:
 
+- bumping `extension/manifest.json` and `package.json` versions on `main` (the workflow automatically creates/updates the matching `vX.Y.Z` GitHub release),
 - pushing a version tag (`v*.*.*`), or
-- manually triggering the **Release Extension** workflow with a version input.
+- manually triggering the **Release Extension** workflow with an optional version input.
 
 Published GitHub releases include the packaged extension zip and checksum, while the recommended user install path remains the Chrome Web Store listing: