diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f753ab0..f214072 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,6 +48,7 @@ jobs:
     needs: [lint, test, docs]
     if: >-
       github.repository == 'DiamondLightSource/myst-version-switcher-plugin' &&
+      github.ref_type != 'tag' &&
       ( github.event_name != 'pull_request' ||
         github.event.pull_request.head.repo.full_name == github.repository )
     uses: ./.github/workflows/publish.yml
@@ -70,18 +71,18 @@ jobs:
   # deploy + verify; its status shows on its own run rather than this tag's CI, which
   # is fine — a tag has no PR to annotate. (Consumers do the same by dispatching their
   # fork-preview wrapper instead — see the how-to.)
-  # publish-tag:
-  #   needs: [lint, test, docs, release]
-  #   if: >-
-  #     github.repository == 'DiamondLightSource/myst-version-switcher-plugin' &&
-  #     github.ref_type == 'tag'
-  #   runs-on: ubuntu-latest
-  #   permissions:
-  #     actions: write     # dispatch publish.yml
-  #   steps:
-  #     - name: Re-deploy via workflow_dispatch (tag trampoline)
-  #       env:
-  #         GH_TOKEN: ${{ github.token }}
-  #         DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-  #       run: |
-  #         gh workflow run publish.yml --repo "$GITHUB_REPOSITORY" --ref "$DEFAULT_BRANCH"
+  publish-tag:
+    needs: [lint, test, docs, release]
+    if: >-
+      github.repository == 'DiamondLightSource/myst-version-switcher-plugin' &&
+      github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write     # dispatch publish.yml
+    steps:
+      - name: Re-deploy via workflow_dispatch (tag trampoline)
+        env:
+          GH_TOKEN: ${{ github.token }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          gh workflow run publish.yml --repo "$GITHUB_REPOSITORY" --ref "$DEFAULT_BRANCH"