diff --git a/.github/workflows/code-tag.yml b/.github/workflows/code-tag.yml
index 4e16e7bf5..44bd3d2f4 100644
--- a/.github/workflows/code-tag.yml
+++ b/.github/workflows/code-tag.yml
@@ -1,18 +1,13 @@
 name: Tag PostHog Code Release
 
 on:
-  push:
+  schedule:
+    - cron: "0 1,17 * * *"
+  workflow_dispatch:
+  pull_request:
+    types: [closed]
     branches:
       - main
-    paths:
-      - "apps/code/**"
-      - "packages/agent/**"
-      - "packages/electron-trpc/**"
-      - "pnpm-lock.yaml"
-      - "package.json"
-      - "turbo.json"
-      - ".github/workflows/code-tag.yml"
-      - ".github/workflows/code-release.yml"
 
 concurrency:
   group: code-tag
@@ -20,6 +15,11 @@ concurrency:
 
 jobs:
   tag:
+    if: >-
+      github.event_name == 'schedule' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+       contains(github.event.pull_request.labels.*.name, 'Create release'))
     permissions:
       contents: write
     runs-on: ubuntu-latest
diff --git a/apps/code/README.md b/apps/code/README.md
index 22f6d9dd1..41c787d3a 100644
--- a/apps/code/README.md
+++ b/apps/code/README.md
@@ -128,11 +128,16 @@ pnpm build-native
 
 PostHog Code uses Electron's built-in `autoUpdater` pointed at the public `update.electronjs.org` service for `PostHog/code`. Every time a non-draft GitHub release is published with the platform archives, packaged apps will automatically download and install the newest version on macOS and Windows.
 
-Publishing a new release:
+There are three ways a release can fire:
+
+1. **Scheduled (default)** — automatic at 17:00 and 01:00 UTC.
+2. **Hotfix** — add the `Create release` label to a PR before it merges. On merge, the tag workflow runs immediately and ships whatever is on `main`.
+3. **Manual** — run `Tag PostHog Code Release` via `workflow_dispatch` from the Actions tab.
+
+Local prep (only needed for one-off manual builds):
 
 1. Export a GitHub token with `repo` scope as `GH_PUBLISH_TOKEN`; set both `GH_TOKEN` and `GITHUB_TOKEN` to its value locally (e.g., in `.envrc`). In GitHub, store the token as the `GH_PUBLISH_TOKEN` repository secret.
-2. Run `pnpm run make` locally to sanity check artifacts, then bump `package.json`'s version (e.g., `pnpm version patch`).
-3. Merge the version bump into `main`. The `Publish Release` GitHub Action auto-detects the new version, tags `vX.Y.Z`, runs `pnpm run publish`, and uploads the release artifacts. You can also run the workflow manually (`workflow_dispatch`) and supply a tag if you need to re-publish.
+2. Run `pnpm run make` to sanity check artifacts.
 
 Set `ELECTRON_DISABLE_AUTO_UPDATE=1` if you ever need to ship a build with auto updates disabled.