diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 369b574..e7371ee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ jobs:
   lint-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v4
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 9f55e0c..85198c2 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -5,6 +5,12 @@ on:
     branches: [main]
   release:
     types: [published]
+  workflow_call:
+    inputs:
+      tag:
+        description: "Release tag to build (e.g. v0.2.0)"
+        required: true
+        type: string
 
 concurrency:
   group: docker-${{ github.ref }}
@@ -21,7 +27,10 @@ jobs:
       attestations: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+          fetch-depth: 0
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 327d077..26fa076 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,6 +3,12 @@ name: Publish to PyPI
 on:
   release:
     types: [published]
+  workflow_call:
+    inputs:
+      tag:
+        description: "Release tag to publish (e.g. v0.2.0)"
+        required: true
+        type: string
 
 jobs:
   publish:
@@ -14,14 +20,18 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+          fetch-depth: 0
 
       - name: Install uv
         uses: astral-sh/setup-uv@v4
 
       - name: Sync versions to release tag
         run: |
-          VERSION="${GITHUB_REF#refs/tags/v}"
+          VERSION="${{ inputs.tag || github.ref_name }}"
+          VERSION="${VERSION#v}"
           # Update pyproject.toml version (what PyPI publishes)
           sed -i -E "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
           # Update server.json version (what MCP Registry records)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 17e96da..b880d21 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,6 +15,8 @@ permissions:
 jobs:
   tag-and-release:
     runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.ver.outputs.tag }}
     steps:
       - name: Ensure release runs from main
         if: github.ref != 'refs/heads/main'
@@ -22,7 +24,7 @@ jobs:
           echo "Releases must be cut from the main branch."
           exit 1
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # need tags to find the latest
 
@@ -46,3 +48,28 @@ jobs:
           gh release create "${{ steps.ver.outputs.tag }}" \
             --title "${{ steps.ver.outputs.tag }}" \
             --generate-notes
+
+  # Call the reusable publish/docker workflows directly rather than relying on
+  # the release event: GITHUB_TOKEN-created releases do not emit events, so
+  # downstream 'on: release' triggers would never fire.
+  publish:
+    needs: tag-and-release
+    uses: ./.github/workflows/publish.yml
+    with:
+      tag: ${{ needs.tag-and-release.outputs.tag }}
+    secrets: inherit
+    permissions:
+      contents: read
+      id-token: write # PyPI trusted publishing + MCP Registry github-oidc
+
+  docker:
+    needs: tag-and-release
+    uses: ./.github/workflows/docker.yml
+    with:
+      tag: ${{ needs.tag-and-release.outputs.tag }}
+    secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write