diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index 122008d..70114e4 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -177,16 +177,17 @@ jobs:
       - name: Generate checksums
         run: npm run release:checksums -- release-assets
 
-      - name: Create or update release
+      - name: Create release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           if gh release view "$VERSION" >/dev/null 2>&1; then
-            gh release upload "$VERSION" release-assets/* --clobber
-          else
-            gh release create "$VERSION" \
-              --verify-tag \
-              --title "SpecDock $VERSION" \
-              --notes-file "docs/release-notes/${VERSION}.md" \
-              release-assets/*
+            echo "::error title=Release already exists::GitHub immutable releases do not allow replacing assets. Create a new patch tag, for example v1.0.1, and run Desktop Release for that tag."
+            exit 1
           fi
+
+          gh release create "$VERSION" \
+            --verify-tag \
+            --title "SpecDock $VERSION" \
+            --notes-file "docs/release-notes/${VERSION}.md" \
+            release-assets/*
diff --git a/docs/RELEASE.md b/docs/RELEASE.md
index 3a9332b..f94a0de 100644
--- a/docs/RELEASE.md
+++ b/docs/RELEASE.md
@@ -29,8 +29,8 @@ npm run release:checksums
 Publish `apps/desktop/release/desktop/SHA256SUMS.txt` alongside the desktop
 downloads so users can verify artifacts.
 
-GitHub-hosted desktop artifacts are published by the `Desktop Release` workflow.
-Push an immutable `v*` tag, or run the workflow manually with an existing tag:
+GitHub-hosted desktop artifacts are published by the `Desktop Release` workflow
+for a new immutable `v*` tag:
 
 ```bash
 git tag v1.0.0
@@ -39,6 +39,8 @@ git push origin v1.0.0
 
 The workflow builds macOS, Windows, and Linux artifacts, generates
 `SHA256SUMS.txt`, and attaches everything to the matching GitHub Release.
+If that release already exists, create a new patch tag instead of replacing
+assets on the published release.
 Desktop artifacts are unsigned by default for open-source releases. If signing
 secrets are configured, macOS and Windows artifacts are signed automatically.