diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 08e8f4ffe5..2d3629c418 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,11 +1,8 @@
 name: Deploy to production
 on:
-  workflow_run:
-    workflows: ["Test"]
-    branches:
-      - release
+  release:
     types:
-      - completed
+      - published
 env:
   PROJECT_ID: ${{ secrets.GKE_PROJECT }}
   GKE_CLUSTER: p5-gke-cluster
@@ -13,7 +10,27 @@ env:
   DEPLOYMENT_NAME: web-editor-node
   IMAGE: ${{ secrets.DOCKER_USERNAME }}/p5.js-web-editor
 jobs:
+  # Only deploy tags whose commit is on the `release` branch
+  verify_release_branch:
+    name: Verify release tag is on the release branch
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          fetch-depth: 0
+      - run: |-
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/release; then
+            printf '::error::Tag %s (%s) is not on the release branch\n' "$RELEASE_TAG" "$GITHUB_SHA"
+            exit 1
+          fi
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+  test:
+    needs: verify_release_branch
+    uses: ./.github/workflows/test.yml
   push_to_registry:
+    needs: test
     environment: production
     name: Push Docker image to Docker Hub
     runs-on: ubuntu-latest
@@ -21,7 +38,7 @@ jobs:
       - name: Check out the repo
         uses: actions/checkout@v3
         with:
-          ref: release
+          ref: ${{ github.event.release.tag_name }}
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
         with:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8067f31487..e3b57f8096 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,7 @@ on:
     branches:
       - develop
       - release
+  workflow_call:
 
 jobs:
   test:
diff --git a/contributor_docs/release.md b/contributor_docs/release.md
index d2e17f5501..d3d4470cb0 100644
--- a/contributor_docs/release.md
+++ b/contributor_docs/release.md
@@ -24,8 +24,8 @@ This project's release guide is based on:
 9. `$ git checkout develop`
 10. `$ git merge --no-ff release-<newversion>`
 11. `$ git push origin develop` (Note: tests need to complete before pushing, which you can check the status of in Github Actions)
-12. [Draft a new release on Github](https://github.com/processing/p5.js-web-editor/releases/new). Choose the tag that is the release version you just created, and then click "Generate release notes" (the title will be autogenerated as well) and publish the release.
-13. Check that Github actions are running.
+12. [Draft a new release on Github](https://github.com/processing/p5.js-web-editor/releases/new). Choose the tag that is the release version you just created, and then click "Generate release notes" (the title will be autogenerated as well) and publish the release. **Publishing the release is what triggers the deploy to production.** The "Deploy to production" workflow first checks that the tag is on the `release` branch, then runs the tests, and only deploys if both pass.
+13. Check that the "Deploy to production" Github action is running and that all of its jobs pass.
 14. `$ kubectl get pods --namespace production` to check the pods are running (this might take a few minutes and you can rerun the command to check again).
 15. Validate that [production](https://stagingeditor.p5js.org/) is working and you are finished!
 
@@ -44,7 +44,8 @@ Sometimes you might need to push a release for an isolated and small bug fix wit
 9. `$ git checkout develop`
 10. `$ git merge --no-ff release-<newversion>`
 11. `$ git push origin develop`
-12. [Draft a new release on Github](https://github.com/processing/p5.js-web-editor/releases/new). Choose the tag that is the release version you just created, and then title it `v<newversion>`. Then click "Generate release notes". Publish the release and you are finished!
+12. [Draft a new release on Github](https://github.com/processing/p5.js-web-editor/releases/new). Choose the tag that is the release version you just created, and then title it `v<newversion>`. Then click "Generate release notes". Publishing the release triggers the deploy to production (which verifies the tag is on `release` and runs the tests before deploying).
+13. Check that the "Deploy to production" Github action passes, then validate that production is working and you are finished!
 
 ### What if the PR Bug Fix is branched from `develop`?