diff --git a/.github/workflows/ci.update-major-version-tag.yaml b/.github/workflows/ci.update-major-version-tag.yaml
index 0937716..682cd39 100644
--- a/.github/workflows/ci.update-major-version-tag.yaml
+++ b/.github/workflows/ci.update-major-version-tag.yaml
@@ -1,12 +1,25 @@
 name: Update major tag
 on:
+  # `release: published` is suppressed when the release is published by the default GITHUB_TOKEN — publish releases as a human (or PAT), never via GITHUB_TOKEN, or v8 silently lags behind.
   release:
     types:
       - published
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Semver tag to align the major tag to (e.g. v8.3.8)"
+        required: true
+
+permissions:
+  contents: write
 
 jobs:
   update-major-tag:
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event.release.prerelease == false }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -15,22 +28,21 @@ jobs:
       - name: Extract major version
         id: version
         run: |
-          # Get the latest tag created by the release job
-          TAG_NAME="$(git describe --tags --abbrev=0)"
-          echo "Retrieved tag: $TAG_NAME"
-          # Extract major version (e.g., v8.2.7 -> v8)
+          TAG_NAME="${{ github.event.inputs.tag || github.event.release.tag_name || github.ref_name }}"
+          echo "Resolved tag: $TAG_NAME"
+          if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::notice::'$TAG_NAME' is not a release semver tag (vX.Y.Z); skipping major-tag update."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           MAJOR_VERSION="$(echo "$TAG_NAME" | sed -E 's/^v([0-9]+)\..*/v\1/')"
           echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT"
           echo "full_version=$TAG_NAME" >> "$GITHUB_OUTPUT"
       - name: Update major version tag
+        if: ${{ steps.version.outputs.skip != 'true' }}
         run: |
           git config user.name "parcellab-dev-bot"
           git config user.email "dev.bot@parcellab.com"
 
-          # Delete existing major version tag if it exists
-          git tag -d "${{ steps.version.outputs.major_version }}" || true
-          git push -d origin "${{ steps.version.outputs.major_version }}" || true
-
-          # Create new major version tag pointing to the same commit as the full version
-          git tag "${{ steps.version.outputs.major_version }}"
-          git push origin tag "${{ steps.version.outputs.major_version }}"
+          git tag -f "${{ steps.version.outputs.major_version }}" "${{ steps.version.outputs.full_version }}"
+          git push origin -f "refs/tags/${{ steps.version.outputs.major_version }}"