diff --git a/.github/workflows/auto-tag.yml b/.github/workflows/auto-tag.yml
index b79beacf..036d5adc 100644
--- a/.github/workflows/auto-tag.yml
+++ b/.github/workflows/auto-tag.yml
@@ -55,7 +55,9 @@ jobs:
           echo "Creating tag: $TAG"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "$TAG" -m "Release $TAG"
+          # The "[auto-tag]" marker in the tag message tells release.yml to skip
+          # this tag (#278, #282). Keep it in sync with the guard job there.
+          git tag -a "$TAG" -m "Release $TAG [auto-tag]"
           git push origin "$TAG"
           echo "Successfully created and pushed tag: $TAG"
           echo "created=true" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8ea3930f..8b2693b2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,8 +32,9 @@ jobs:
   # 0. Skip tags pushed by auto-tag.yml. auto-tag pushes with RELEASE_PAT, which
   #    (unlike GITHUB_TOKEN) fires this workflow too; without this guard both
   #    workflows create the same release and race on the SBOM upload (#278).
-  #    auto-tag creates annotated tags as github-actions[bot], so the tagger
-  #    tells them apart from tags pushed by hand.
+  #    auto-tag puts an explicit "[auto-tag]" marker in the tag message (#282).
+  #    The github-actions[bot] tagger check covers tags created before the
+  #    marker was introduced.
   guard:
     runs-on: ubuntu-latest
     outputs:
@@ -51,11 +52,13 @@ jobs:
           fi
           read -r TYPE SHA < <(gh api "repos/${{ github.repository }}/git/ref/tags/${TAG}" --jq '.object.type + " " + .object.sha')
           TAGGER=""
+          MESSAGE=""
           if [ "$TYPE" = "tag" ]; then
             TAGGER=$(gh api "repos/${{ github.repository }}/git/tags/${SHA}" --jq '.tagger.name')
+            MESSAGE=$(gh api "repos/${{ github.repository }}/git/tags/${SHA}" --jq '.message')
           fi
-          echo "Tag ${TAG}: type=${TYPE}, tagger=${TAGGER:-<none>}"
-          if [ "$TAGGER" = "github-actions[bot]" ]; then
+          echo "Tag ${TAG}: type=${TYPE}, tagger=${TAGGER:-<none>}, message=${MESSAGE:-<none>}"
+          if [[ "$MESSAGE" == *"[auto-tag]"* ]] || [ "$TAGGER" = "github-actions[bot]" ]; then
             echo "Tag was created by auto-tag.yml, which handles the release. Skipping."
             echo "skip=true" >> "$GITHUB_OUTPUT"
           else