diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 364ada1d..f490dd0f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -223,17 +223,18 @@ jobs:
       if: startsWith(github.ref, 'refs/tags/v')  # only on runs triggered from tag
       run: |
         SHORT_VERSION="${GITHUB_REF_NAME#v}"
-        COMMITTED_VERSION=$(sed -n -E "s/^[[:space:]]*versionName[[:space:]]+['\"]([^'\"]+)['\"].*/\\1/p" mobile/build.gradle)
+        COMMITTED_VERSION=$(sed -n -E "s/^[[:space:]]*versionName[[:space:]]+['\"]([^'\"]+)['\"].*/\1/p" mobile/build.gradle)
         if [ -z "$COMMITTED_VERSION" ]; then
           echo "Failed to parse versionName from mobile/build.gradle."
           exit 1
         fi
         if [ "$COMMITTED_VERSION" != "$SHORT_VERSION" ]; then
           echo "mobile/build.gradle versionName must match the release tag."
+          echo "Use the Release workflow (workflow_dispatch) to bump, commit, and tag in one step."
           echo "tag=$SHORT_VERSION committed=$COMMITTED_VERSION"
           exit 1
         fi
-
+        echo "versionName ${COMMITTED_VERSION} matches tag ${GITHUB_REF_NAME}"
     - name: Set versionCode
       run: |
         # Sets versionCode
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..e1724026
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,71 @@
+name: Release
+
+# Full release workflow: bumps versionName in source, commits, tags, and pushes.
+# The tag push (via RELEASE_PAT) triggers the Build workflow automatically.
+#
+# Prerequisites:
+#   - Add a RELEASE_PAT secret: a GitHub PAT with `repo` scope.
+#     Using a PAT instead of GITHUB_TOKEN ensures the tag push triggers Build.
+#
+# Usage: Actions → Release → Run workflow → enter version (e.g. 0.12.2)
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to release, without v prefix (e.g. 0.12.2)'
+        required: true
+        type: string
+
+jobs:
+  release:
+    name: Bump versionName, commit, and tag
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # RELEASE_PAT is a repo-scoped PAT; its pushes trigger the Build workflow.
+          # Falls back to GITHUB_TOKEN (build won't auto-trigger, but tag is still created).
+          token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Validate version format
+        run: |
+          VERSION="${{ inputs.version }}"
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Version must be X.Y.Z (e.g. 0.12.2). Got: ${VERSION}"
+            exit 1
+          fi
+          if git rev-parse "refs/tags/v${VERSION}" >/dev/null 2>&1; then
+            echo "::error::Tag v${VERSION} already exists."
+            exit 1
+          fi
+
+      - name: Bump versionName in mobile/build.gradle
+        run: |
+          VERSION="${{ inputs.version }}"
+          # Replace quoted versionName value; works for both single and double quotes.
+          sed -i -E "s/^([[:space:]]*versionName[[:space:]]+)[\"'][^\"']+[\"']/\1'${VERSION}'/" \
+            mobile/build.gradle
+          # Verify: the line must end with the closing quote (no dangling chars).
+          grep -qE "^[[:space:]]*versionName[[:space:]]+'${VERSION}'[[:space:]]*$" \
+            mobile/build.gradle || {
+              echo "::error::versionName update failed. Current state:"
+              grep "versionName" mobile/build.gradle
+              exit 1
+            }
+          echo "Updated versionName to '${VERSION}'"
+
+      - name: Commit and tag
+        run: |
+          VERSION="${{ inputs.version }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add mobile/build.gradle
+          git commit -m "chore: bump versionName to ${VERSION}"
+          git tag -a "v${VERSION}" -m "Release v${VERSION}"
+          git push origin HEAD:master
+          git push origin "v${VERSION}"
diff --git a/README.md b/README.md
index 6b19f9b4..2ad2d726 100644
--- a/README.md
+++ b/README.md
@@ -57,20 +57,26 @@ Once both aw-server-rust and aw-webui is built, you can build the Android app as
 
 ### Making a release
 
-Before tagging, update `mobile/build.gradle` so `versionName` matches the
-release you are about to cut. The release workflow verifies the committed
-`versionName` instead of patching it after checkout, which keeps tagged source,
-GitHub release builds, and F-Droid builds on the same version.
+Use the **Release** workflow to bump the version, commit it, and create the
+tag in one atomic step. This ensures the committed `versionName` matches the
+tag (required for F-Droid, which builds from tagged source).
 
-Then make a signed tag and push it to GitHub:
+1. Go to **Actions → Release → Run workflow**
+2. Enter the version number (e.g. `0.12.2`, without the `v` prefix)
+3. Click **Run workflow**
 
-```sh
-git tag -s v0.1.0
-git push origin refs/tags/v0.1.0
-```
+The workflow will:
+- Update `versionName` in `mobile/build.gradle`
+- Commit the change to master
+- Create and push tag `v{version}`
+- Trigger the Build workflow (requires a `RELEASE_PAT` secret — a GitHub PAT with `repo` scope)
 
 This will trigger a GitHub Actions workflow which will build the app and upload it to GitHub releases, and deploy it to the Play Store (including the metadata in `./fastlane/metadata/android`).
 
+> **Note for maintainers:** Add a `RELEASE_PAT` secret (repo-scoped GitHub PAT) so
+> the tag push from the Release workflow triggers the Build workflow. Without it,
+> the Build workflow must be triggered manually after the tag is pushed.
+
 ## More info
 
 For more info, check out the main [ActivityWatch repo](https://github.com/ActivityWatch/activitywatch).