diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 29e3642..8c45b9a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,11 @@ name: CI
 
 on:
   workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Existing immutable tag to publish
+        required: false
+        type: string
   pull_request:
   push:
     branches:
@@ -82,7 +87,9 @@ jobs:
 
   publish-kotlin:
     name: Publish Kotlin artifact
-    if: startsWith(github.ref, 'refs/tags/')
+    if: >-
+      startsWith(github.ref, 'refs/tags/') ||
+      (github.event_name == 'workflow_dispatch' && inputs.release_tag != '')
     needs:
       - contract
       - swift
@@ -93,6 +100,8 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.release_tag || github.ref }}
 
       - name: Set up Node.js
         uses: actions/setup-node@v7
@@ -102,9 +111,11 @@ jobs:
       - name: Verify release tag
         run: >-
           node -e 'const version = require("./package.json").version;
-          if (process.env.GITHUB_REF_NAME !== version) {
-          throw new Error(`Tag ${process.env.GITHUB_REF_NAME} does not match version ${version}`);
+          if (process.env.RELEASE_TAG !== version) {
+          throw new Error(`Tag ${process.env.RELEASE_TAG} does not match version ${version}`);
           }'
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
 
       - name: Set up Java
         uses: actions/setup-java@v5
diff --git a/test/ci-workflow.test.mjs b/test/ci-workflow.test.mjs
index 93afe8a..acd17a5 100644
--- a/test/ci-workflow.test.mjs
+++ b/test/ci-workflow.test.mjs
@@ -10,3 +10,14 @@ test("Kotlin publication disables the unsupported configuration cache", async ()
     /--no-configuration-cache\s+:AstrolabeProtocolKotlin:publishAndReleaseToMavenCentral/
   );
 });
+test("Kotlin publication can retry an immutable release tag", async () => {
+  const workflow = await readFile(".github/workflows/ci.yml", "utf8");
+
+  assert.match(workflow, /release_tag:/);
+  assert.match(workflow, /inputs\.release_tag != ''/);
+  assert.match(workflow, /ref: \$\{\{ inputs\.release_tag \|\| github\.ref \}\}/);
+  assert.match(
+    workflow,
+    /RELEASE_TAG: \$\{\{ inputs\.release_tag \|\| github\.ref_name \}\}/
+  );
+});