diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f92ac9f..6ab3c8d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,6 +3,7 @@ name: Publish to npm
 on:
   push:
     branches: [main]
+  workflow_dispatch: {}
 
 concurrency:
   group: publish
@@ -17,6 +18,9 @@ jobs:
       - uses: actions/checkout@v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+          # Full history + stay on the branch so the bump step can rebase + push.
+          fetch-depth: 0
+          ref: main
 
       - uses: pnpm/action-setup@v4
         with:
@@ -33,11 +37,13 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          npm version patch --no-git-tag-version
-          VERSION=$(node -p "require('./package.json').version")
+          # Re-base onto the latest main first so a re-run or a race never hits a
+          # non-fast-forward push (the old failure mode).
+          git pull --rebase origin main
+          VERSION=$(npm version patch --no-git-tag-version)
           git add package.json
-          git commit -m "chore: bump version to $VERSION [skip ci]"
-          git push
+          git commit -m "chore: bump version to ${VERSION} [skip ci]"
+          git push origin HEAD:main
 
       - run: pnpm build