diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7d7183f90..57de6e626 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,14 +1,24 @@
 name: Publish
 
-on: registry_package
+on:
+  registry_package:
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'Package dir name under @ecomplus/ (e.g. storefront-app)'
+        required: true
+        type: string
 
 jobs:
   publish:
     name: Publish to npm
     runs-on: ubuntu-latest
     env:
-      PKG_OWNER: ${{ github.event.registry_package.owner.login }}
-      PKG_NAME: ${{ github.event.registry_package.name }}
+      PKG_OWNER: ${{ github.event.registry_package.owner.login || 'ecomplus' }}
+      PKG_NAME: ${{ github.event.registry_package.name || inputs.package }}
+      # setup-node writes `.npmrc` with `${NODE_AUTH_TOKEN}` and, since v7, no
+      # longer exports a placeholder: npm 6 aborts `npm i` when the var is unset
+      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
     steps:
       - name: Checkout
@@ -24,7 +34,9 @@ jobs:
         run: npm i
 
       - name: Build package
-        run: npx lerna run --scope=@$PKG_OWNER/$PKG_NAME build
+        # explicit local bin: without node_modules `npx lerna` falls back to the
+        # runner's global (latest) lerna, which needs Node 18+ and crashes on Node 14
+        run: ./node_modules/.bin/lerna run --scope=@$PKG_OWNER/$PKG_NAME build
 
       - name: Edit package.json and publish to npm registry
         env:
@@ -37,7 +49,7 @@ jobs:
           npm publish --access public
 
       - name: Trigger Netlify deploy
-        if: github.event.registry_package.name == 'storefront-template'
+        if: env.PKG_NAME == 'storefront-template'
         env:
           NETLIFY_HOOK_ENDPOINT: ${{ secrets.NETLIFY_HOOK_ENDPOINT }}
         run: |