diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 44421ade..d396d7ad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,55 +1,43 @@
+# Release and recovery: https://github.com/nlibjs/actions#release-procedure
+# npm Trusted Publisher: nlibjs/lint-commit, release.yml, environment: deployment.
+# Stage requires deployment approval when environment protection is enabled.
 name: Release
-
 on:
-  push:
-    branches: [main]
-    paths: [package.json]
+  release:
+    types: [published]
   workflow_dispatch:
     inputs:
       action:
         description: Operation
         type: choice
-        options: [verify, stage, finalize]
+        options: [verify, stage]
         default: verify
         required: true
-      version:
-        description: "Required for finalize only, e.g. 1.2.3"
+      tag:
+        description: "Published Release tag for retry, e.g. v1.2.3"
         type: string
         default: ""
-        required: false
-
 permissions:
   contents: read
-
 concurrency:
-  group: release
+  group: release-${{ github.event.release.tag_name || inputs.tag || github.ref }}
   cancel-in-progress: false
-
 jobs:
   Verify:
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.action == 'verify'
+    if: github.event_name == 'workflow_dispatch' && inputs.action == 'verify'
     permissions:
       contents: read
-    uses: nlibjs/actions/.github/workflows/npm-release.yml@986b87befafad2f4f990c934165a90ea37ddbf36
+    uses: nlibjs/actions/.github/workflows/npm-release.yml@cde77910e399ec821de29a242f01e44311461605
     with:
       action: verify
-
   Stage:
-    if: github.event_name == 'push' || github.event.inputs.action == 'stage'
+    if: (github.event_name == 'release' && !github.event.release.prerelease) || inputs.action == 'stage'
     permissions:
-      contents: write
+      contents: read
+      actions: read
       id-token: write
-    uses: nlibjs/actions/.github/workflows/npm-release.yml@986b87befafad2f4f990c934165a90ea37ddbf36
+    uses: nlibjs/actions/.github/workflows/npm-release.yml@cde77910e399ec821de29a242f01e44311461605
     with:
       action: stage
+      tag: ${{ github.event.release.tag_name || inputs.tag }}
       environment: deployment
-
-  Finalize:
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.action == 'finalize'
-    permissions:
-      contents: write
-    uses: nlibjs/actions/.github/workflows/npm-release.yml@986b87befafad2f4f990c934165a90ea37ddbf36
-    with:
-      action: finalize
-      environment: deployment
-      version: ${{ github.event.inputs.version }}
diff --git a/README.md b/README.md
index 3c676e52..0d02785f 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,3 @@ Then, set `@nlib/lint-commit` to `commit-msg` hook.
 #!/bin/sh
 npx @nlib/lint-commit --input "$1"
 ```
-
-## Releases
-
-Maintainers can follow the [release guide](docs/releases.md).
diff --git a/docs/releases.md b/docs/releases.md
deleted file mode 100644
index 51b4ba74..00000000
--- a/docs/releases.md
+++ /dev/null
@@ -1,34 +0,0 @@
-# Maintainer release guide
-
-The Release workflow pins `nlibjs/actions` to `986b87befafad2f4f990c934165a90ea37ddbf36`, with helper `70dd80ae972e812efcc9606d0ec5d514c8be3982`.
-
-## Configuration
-
-Configure npm Trusted Publisher for `@nlib/lint-commit` with these values:
-
-| Setting | Value |
-| --- | --- |
-| Organization or user | `nlibjs` |
-| Repository | `lint-commit` |
-| Workflow filename | `release.yml` |
-| Environment | `deployment` |
-
-Stage and Finalize use the repository's `deployment` environment. Each operation requires its environment approval if protection rules are configured. Verify runs without that environment.
-
-## Operations
-
-1. For a nonpublishing check, select **Release → Run workflow**, choose a branch, select `action=verify`, and leave version empty. Verify runs lint, tests, build, cleanup and tarball checks.
-2. Prepare a normal version and changelog update, then merge to main. A package.json push starts Stage automatically. Manual Stage on main accepts the current package version; leave version empty.
-3. Check the Stage run and its saved draft for the intended package/version.
-4. Approve the exact version on npmjs.com's **Staged Packages** page with maintainer 2FA.
-5. Run Release on `main` with `action=finalize` and the approved version without `v`.
-
-Manual dispatch defaults to Verify. Stage and Finalize require main. This package publishes to npm and GitHub Releases.
-
-## Recovery
-
-Follow the shared workflow's [recovery procedure](https://github.com/nlibjs/actions/blob/986b87befafad2f4f990c934165a90ea37ddbf36/README.md#existing-versions-and-failures) for failed or partial releases.
-
-## Updating the workflow
-
-Update all three full SHA references in `.github/workflows/release.yml` together. Confirm that the workflow and its helper pin are preserved in shared main history, Stage and Finalize still use `deployment`, and the existing Lint and Test checks pass before merging.