diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
index ad6fb2c..3f84904 100644
--- a/.github/workflows/python-release.yml
+++ b/.github/workflows/python-release.yml
@@ -5,6 +5,9 @@ on:
     branches: ["main", "master"]
     paths:
       - "CHANGELOG.md"
+  # Retry a release whose publish failed; the existing-release check below
+  # still prevents publishing the same version twice.
+  workflow_dispatch:
 
 permissions: {}
 
@@ -56,8 +59,14 @@ jobs:
         id: version-changed
         env:
           BEFORE_SHA: ${{ github.event.before }}
+          EVENT_NAME: ${{ github.event_name }}
           VERSION: ${{ steps.release.outputs.version }}
         run: |
+          # Manual runs have no "before" commit; rely on the existing-release check.
+          if [ "${EVENT_NAME}" = "workflow_dispatch" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           previous_version=$(git show "${BEFORE_SHA}:pyproject.toml" | python -c '
           import sys
           import tomllib
@@ -119,7 +128,7 @@ jobs:
 
       - name: Publish package
         if: steps.version-changed.outputs.changed == 'true' && steps.existing-release.outputs.exists == 'false'
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           user: __token__
           password: ${{ secrets.pypi_password }}