diff --git a/.github/workflows/push-main.yaml b/.github/workflows/push-main.yaml
index d13974c..ecfc645 100644
--- a/.github/workflows/push-main.yaml
+++ b/.github/workflows/push-main.yaml
@@ -21,3 +21,18 @@ jobs:
 
             - name: Run CI checks
               uses: ./.github/actions/ci
+
+    tag:
+        name: Tag release
+        runs-on: ubuntu-26.04
+        timeout-minutes: 5
+        permissions: {}
+        concurrency:
+            group: ${{ github.workflow }}-${{ github.job }}
+            cancel-in-progress: false
+        steps:
+            - name: Tag the release
+              uses: dnd-mapp/action-tag-release@4dd5358fba157c26f18e63250502476108d9fa43 # v1.0.0
+              with:
+                  client-id: ${{ vars.GH_APP_CLIENT_ID }}
+                  private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
diff --git a/AGENTS.md b/AGENTS.md
index 2808582..c3983ca 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -27,4 +27,4 @@ Turn on auto-merge for every pull request you open, so it merges as soon as it i
 
 - A draft cannot have auto-merge. Mark it ready with `gh pr ready <number>` first, then run the command above.
 - When the user asks to keep a pull request open, leave auto-merge off. If it is already on, turn it off with `gh pr merge <number> --disable-auto`.
-- Release pull requests (`chore: release X.Y.Z`) come from the Prepare release workflow, which turns on auto-merge itself. Do not prepare a release commit by hand. The release starts only when the maintainer pushes the `vX.Y.Z` tag on the merge commit by hand, as `CONTRIBUTING.md` describes.
+- Release pull requests (`chore: release X.Y.Z`) come from the Prepare release workflow, which turns on auto-merge itself. Do not prepare a release commit by hand. The `tag` job of the Push main workflow tags their merge commit, which starts the release.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index afdddbe..ea98f72 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -77,7 +77,7 @@ Enabling a stricter rule or lowering a limit can make commits that passed before
 ## Releasing
 
 1. Run the [prepare release workflow](.github/workflows/prepare-release.yaml) on `main` with the part of the version to bump, for example `gh workflow run prepare-release.yaml -f bump=minor`. It opens the `chore: release X.Y.Z` pull request with auto-merge on.
-2. Review and approve the pull request. Once it merges, create an annotated tag `vX.Y.Z` on the merge commit and push the tag.
+2. Review and approve the pull request. Once it merges, the `tag` job of the [push workflow](.github/workflows/push-main.yaml) creates the annotated tag `vX.Y.Z` on the merge commit.
 3. The [release workflow](.github/workflows/release.yaml) runs the CI checks, verifies the tag and the changelog, stages the package on npm, and creates the GitHub Release.
 4. Find the staged version with `pnpm stage list` and approve it with `pnpm stage approve <id>` and 2FA.