diff --git a/.github/workflows/drawio-export.yml b/.github/workflows/drawio-export.yml
index 4f7c7db..e450cec 100644
--- a/.github/workflows/drawio-export.yml
+++ b/.github/workflows/drawio-export.yml
@@ -1,6 +1,8 @@
 name: Keep draw.io export synchronized
 on:
   push:
+    branches:
+      - "**"
     paths:
       - "**.drawio"
       - .github/workflows/drawio-export.yml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8d9a1f4..dd82c41 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,11 @@ on:
     tags:
       - 'v*'
   workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Git tag to upload to Maven Central
+        required: true
+        type: string
 
 jobs:
   release:
@@ -15,6 +20,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.release_tag) || github.ref }}
 
       - name: Set up JDK 21
         uses: actions/setup-java@v4
@@ -33,6 +39,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           JRELEASER_MAVENCENTRAL_STAGE: UPLOAD
+          JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.JRELEASER_GPG_PUBLIC_KEY }}
           JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
           JRELEASER_GPG_PASSPHRASE: ${{ secrets.JRELEASER_GPG_PASSPHRASE }}
           MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
diff --git a/README.md b/README.md
index f7dc618..a4a6bc6 100644
--- a/README.md
+++ b/README.md
@@ -93,12 +93,15 @@ The release flow expects these environment variables:
 - `GITHUB_TOKEN`
 - `MAVEN_CENTRAL_USERNAME`
 - `MAVEN_CENTRAL_PASSWORD`
+- `JRELEASER_GPG_PUBLIC_KEY`
 - `JRELEASER_GPG_SECRET_KEY`
 - `JRELEASER_GPG_PASSPHRASE`
 
 GitHub Actions mirrors the same flow in `.github/workflows/release.yml`.
 
-For GitHub Actions, the workflow uploads the deployment to Maven Central with `JRELEASER_MAVENCENTRAL_STAGE=UPLOAD` and leaves the final publication confirmation to be done manually in the Central Portal.
+For GitHub Actions, trigger the workflow manually with `workflow_dispatch` and provide the Git tag to upload. The workflow checks out that tag, uploads the deployment to Maven Central with `JRELEASER_MAVENCENTRAL_STAGE=UPLOAD`, and leaves the final publication confirmation to be done manually in the Central Portal.
+
+JReleaser PGP signing in memory also requires the ASCII-armored public key, so `JRELEASER_GPG_PUBLIC_KEY` must be configured together with the private key and passphrase.
 
 ## Messaging delivery semantics and error handling