diff --git a/.github/workflows/publish-cvcgl-wasm.yml b/.github/workflows/publish-cvcgl-wasm.yml
index ac15b5d16..25710df12 100644
--- a/.github/workflows/publish-cvcgl-wasm.yml
+++ b/.github/workflows/publish-cvcgl-wasm.yml
@@ -16,10 +16,14 @@ name: publish-cvcgl-wasm
 #
 # Runner-agnostic: runs on GitHub-hosted ubuntu-latest and provisions the emsdk
 # toolchain + cmake/ninja from the cvcpkg catalog, so it is not tied to any one
-# box (it used to require catx-03's pre-installed /opt/cvc-wasm/emsdk). Dry-run by
-# default (builds + packs, no publish); set dry_run=false to publish.
+# box (it used to require catx-03's pre-installed /opt/cvc-wasm/emsdk). A v* tag
+# push builds AND publishes, like publish-cvcpkg.yml; a manual dispatch is a dry run
+# by default (builds + packs, no publish) -- set dry_run=false to publish.
 
 on:
+  push:
+    tags:
+      - 'v*'
   workflow_dispatch:
     inputs:
       dry_run:
@@ -42,6 +46,8 @@ jobs:
       EMSDK_DIR: ${{ github.workspace }}/emsdk
       WASM_DEPS: ${{ github.workspace }}/wasm-deps
       INST: ${{ github.workspace }}/wasm-inst
+      # Only a manual dispatch can dry-run; a tag push always publishes.
+      DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
     steps:
       - uses: actions/checkout@v4
 
@@ -147,7 +153,7 @@ jobs:
               --local --output-dir dist
           done
           ls -la dist/
-          if [ "${{ inputs.dry_run }}" = "true" ]; then
+          if [ "$DRY_RUN" = "true" ]; then
             echo "dry-run: built + packed, not publishing"; exit 0
           fi
           [ -n "${CVCPKG_TOKEN:-}" ] || { echo "::error::CVCPKG_TOKEN required to publish"; exit 1; }
@@ -212,7 +218,7 @@ jobs:
             --platform wasm-mt --config release --link static \
             --local --output-dir dist
           ls -la dist/cvcgl-examples-*wasm-mt* || true
-          if [ "${{ inputs.dry_run }}" = "true" ]; then
+          if [ "$DRY_RUN" = "true" ]; then
             echo "dry-run: built + packed cvcgl-examples gallery, not publishing"; exit 0
           fi
           [ -n "${CVCPKG_TOKEN:-}" ] || { echo "::error::CVCPKG_TOKEN required to publish"; exit 1; }
diff --git a/.github/workflows/publish-pycvc-gl-wasm.yml b/.github/workflows/publish-pycvc-gl-wasm.yml
index 76391ce32..efe31f477 100644
--- a/.github/workflows/publish-pycvc-gl-wasm.yml
+++ b/.github/workflows/publish-pycvc-gl-wasm.yml
@@ -6,8 +6,13 @@ name: publish-pycvc-gl-wasm
 # browser. Runner-agnostic (ubuntu-latest), self-provisioning emsdk + cmake/ninja
 # from the cvcpkg catalog, mirroring publish-cvcgl-wasm.yml. The wasm deps are
 # INSTALLED into the build prefix first (cvcpkg build reads them as CVC_DEPS_PREFIX;
-# without them configure fails at find_package(Boost)). dry_run=false to publish.
+# without them configure fails at find_package(Boost)). A v* tag push publishes, like
+# publish-cvcpkg.yml; a manual dispatch publishes only with dry_run=false. It compiles
+# cvc + cvcGL from source, so it does not wait on publish-cvcgl-wasm's bundles.
 on:
+  push:
+    tags:
+      - 'v*'
   workflow_dispatch:
     inputs:
       dry_run:
@@ -92,7 +97,7 @@ jobs:
           if-no-files-found: warn
 
       - name: Publish pycvc-gl-cp312 wasm
-        if: ${{ inputs.dry_run == false }}
+        if: ${{ github.event_name == 'push' || inputs.dry_run == false }}
         run: |
           cvcpkg pack cvcpkg/recipes/pycvc-gl-cp312 --from-prefix "$WASM_DEPS" \
             --platform wasm --config release --link static --output-dir dist