diff --git a/.github/workflows/publish-release-artifacts.yml b/.github/workflows/publish-release-artifacts.yml
new file mode 100644
index 00000000..8b3567f5
--- /dev/null
+++ b/.github/workflows/publish-release-artifacts.yml
@@ -0,0 +1,67 @@
+name: Publish Existing Artifacts to Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      run_id:
+        description: 'Workflow Run ID with built artifacts'
+        required: true
+        default: '40649093060'
+        type: string
+      release_tag:
+        description: 'Release tag (e.g. nightly or v6.0.0)'
+        required: true
+        default: 'nightly'
+        type: string
+      release_name:
+        description: 'Release name'
+        required: false
+        default: 'Spotube Multiplatform Build (nightly)'
+        type: string
+      prerelease:
+        description: 'Mark as pre-release'
+        required: false
+        default: true
+        type: boolean
+
+permissions:
+  contents: write
+
+jobs:
+  publish-artifacts:
+    name: Publish Artifacts to GitHub Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download all artifacts from run
+        uses: actions/download-artifact@v4
+        with:
+          run-id: ${{ inputs.run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          path: downloaded-artifacts
+
+      - name: Inspect and organize artifacts
+        run: |
+          mkdir -p release-files
+          find downloaded-artifacts -type f \( -name "*.apk" -o -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.tar.xz" -o -name "*.exe" -o -name "*.dmg" -o -name "*.ipa" \) -exec cp {} release-files/ \;
+          ls -lh release-files/
+
+      - name: Generate release notes
+        run: |
+          echo "## Downloads" > release-notes.md
+          echo "" >> release-notes.md
+          for f in release-files/*; do
+            if [ -f "$f" ]; then
+              echo "- \`$(basename "$f")\`" >> release-notes.md
+            fi
+          done
+
+      - name: Upload to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.release_tag }}
+          name: ${{ inputs.release_name }}
+          body_path: release-notes.md
+          prerelease: ${{ inputs.prerelease }}
+          draft: false
+          fail_on_unmatched_files: false
+          files: release-files/*
diff --git a/.github/workflows/spotube-release-binary.yml b/.github/workflows/spotube-release-binary.yml
index 9aa39933..b64aa8d4 100644
--- a/.github/workflows/spotube-release-binary.yml
+++ b/.github/workflows/spotube-release-binary.yml
@@ -69,9 +69,8 @@ on:
         type: boolean
         default: false
 
-# Read-only by default; only create-release gets write access
 permissions:
-  contents: read
+  contents: write
 
 # Never cancel a running release when another is dispatched, and let stable, beta and nightly run side by side
 concurrency:
@@ -724,11 +723,9 @@ jobs:
 
       - name: Create or Update Release
         if: steps.check_artifacts.outputs.has_artifacts == 'true'
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.vars.outputs.tag }}
-          # A new tag (stable) would otherwise point at the default branch instead of the built commit
-          target_commitish: ${{ github.sha }}
           fail_on_unmatched_files: false
           name: ${{ steps.vars.outputs.release_name }}
           body_path: release-notes.md