diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 243e5aa..bb3b068 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,7 @@ jobs:
       actions: write
       contents: write
       id-token: write
+      pull-requests: write
     steps:
     - name: 📥 checkout
       uses: actions/checkout@v7
@@ -33,6 +34,13 @@ jobs:
           release_sha=$(git rev-parse HEAD)
           release_branch="release/${release_tag}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
           git push origin "HEAD:refs/heads/${release_branch}"
+          release_pr_body=$'# Problem\n\n- Generated release metadata must pass protected-main checks.\n\n# Solution\n\n- Apply the version and changelog generated by Python Semantic Release.'
+          release_pr_url=$(gh pr create \
+            --base main \
+            --head "$release_branch" \
+            --title "chore(release): ${release_tag}" \
+            --body "$release_pr_body")
+          release_pr_number=$(gh pr view "$release_pr_url" --json number --jq .number)
           gh workflow run ci.yml --ref "$release_branch"
 
           ci_run_id=""
@@ -56,10 +64,26 @@ jobs:
           fi
 
           gh run watch "$ci_run_id" --exit-status
-          git push --atomic origin \
-            "HEAD:refs/heads/main" \
-            "refs/tags/${release_tag}:refs/tags/${release_tag}"
-          git push origin --delete "$release_branch"
+          merge_response=$(gh api \
+            --method PUT \
+            "repos/${GITHUB_REPOSITORY}/pulls/${release_pr_number}/merge" \
+            -f merge_method=squash \
+            -f sha="$release_sha" \
+            -f commit_title="chore(release): ${release_tag}" \
+            -f commit_message="Automatically generated by python-semantic-release")
+          if [[ "$(jq -r .merged <<< "$merge_response")" != "true" ]]; then
+            jq -r .message <<< "$merge_response" >&2
+            exit 1
+          fi
+
+          merge_sha=$(jq -r .sha <<< "$merge_response")
+          git fetch origin main
+          git merge-base --is-ancestor "$merge_sha" origin/main
+          git tag --force --annotate "$release_tag" "$merge_sha" --message "$release_tag"
+          git push origin "refs/tags/${release_tag}:refs/tags/${release_tag}"
+          if git ls-remote --exit-code --heads origin "$release_branch" >/dev/null; then
+            git push origin --delete "$release_branch"
+          fi
           gh workflow run doc.yml --ref "$release_tag"
           uv run semantic-release changelog --post-to-release-tag "$release_tag"
           echo "🙆🏽 Publishing on PyPI"