diff --git a/.github/workflows/publish-web.yaml b/.github/workflows/publish-web.yaml
index 7d173b5b9171..82a494a9e047 100644
--- a/.github/workflows/publish-web.yaml
+++ b/.github/workflows/publish-web.yaml
@@ -1,11 +1,9 @@
 name: publish-web
 on:
-  # A release ends by pushing its docs to `web` with the bot's PAT, and a push
-  # made with a PAT does start workflows, so this covers releases too.
   push:
     branches:
       - web
-  # Called by pull-request when specifically requested
+  # Called by `release` on a release, and by `tests` on a `pr-publish-web` label
   workflow_call:
   workflow_dispatch:
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 27c825d159c3..0c4824d84a86 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -426,15 +426,25 @@ jobs:
   #         nexus_password: ${{ secrets.nexus_password }}
   #         directory: prql-java/java/
 
+  publish-web:
+    if: github.event_name == 'release'
+    uses: ./.github/workflows/publish-web.yaml
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+
+  # `web` tracks the latest release, so doc-only fixes backport onto it. A push
+  # with the default token starts no workflow, so `publish-web` is the release's
+  # only publish.
   push-web-branch:
     runs-on: ubuntu-24.04
-    environment: release
     if: github.event_name == 'release'
+    permissions:
+      contents: write
     steps:
       - name: 📂 Checkout code
         uses: actions/checkout@v7
-        with:
-          token: ${{ secrets.TEND_BOT_TOKEN }}
       - run: git push origin HEAD:web --force
 
   push-devcontainer:
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index e20cb8771937..4c9c9984e911 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -347,6 +347,10 @@ jobs:
   publish-web:
     uses: ./.github/workflows/publish-web.yaml
     if: contains(github.event.pull_request.labels.*.name, 'pr-publish-web')
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
 
   nightly:
     needs: rules
diff --git a/web/book/src/project/contributing/development.md b/web/book/src/project/contributing/development.md
index 72dab4d8462d..cc0d2cf80916 100644
--- a/web/book/src/project/contributing/development.md
+++ b/web/book/src/project/contributing/development.md
@@ -410,8 +410,8 @@ the confidence to make changes faster, please raise an issue.
 
 ## Website
 
-The website is published together with the book and the playground, and is
-automatically built and released on any push to the `web` branch.
+The website is published together with the book and the playground, from a
+release's tag and from any later push to the `web` branch.
 
 The `web` branch points to the latest release plus any website-specific fixes.
 That way, the compiler behavior in the playground matches the latest release
@@ -498,9 +498,11 @@ Currently we release in a semi-automated way:
    )"
    ```
 
-4. From there, both the tag and release is created and all packages are
-   published automatically based on our
-   [release workflow](https://github.com/PRQL/prql/blob/main/.github/workflows/release.yaml).
+4. From there the tag and release are created, and the
+   [release workflow](https://github.com/PRQL/prql/blob/main/.github/workflows/release.yaml)
+   publishes the packages and the website. Its publishing jobs sit behind the
+   `release` and `github-pages` environments, so approve the pending deployments
+   on the run's page.
 
 5. Run
    `cargo release patch --no-publish --no-push --execute --no-verify --no-confirm --no-tag && task prqlc:test-all && cargo insta test --accept -p mdbook-prql`