diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
deleted file mode 100644
index a93c4f9..0000000
--- a/.github/workflows/publish-image.yml
+++ /dev/null
@@ -1,51 +0,0 @@
-name: publish-image
-
-# Publishes the scope image to ECR Public on every semver tag (created by the
-# release workflow). Result: public.ecr.aws/nullplatform/scopes/lambda:<version>
-on:
-  push:
-    tags:
-      - 'v*'
-
-permissions:
-  id-token: write   # required for OIDC auth against AWS
-  contents: read
-
-jobs:
-  publish:
-    uses: nullplatform/actions-nullplatform/.github/workflows/docker-build-push-ecr.yml@main
-    with:
-      image_name: scopes/lambda
-      context: .
-      tag: ${{ github.ref_name }}
-    secrets:
-      aws_role_arn: ${{ secrets.AWS_ROLE_ARN_ECR_PUSH }}
-
-  # Register the pushed image as a platform artifact, pinned by its digest and
-  # visible to every organization — so `np package publish` / scope_definition
-  # can resolve it. Idempotent upsert: re-runs of the same digest return the
-  # same ids.
-  publish-artifact:
-    name: Register oci_image artifact
-    needs: publish
-    runs-on: ubuntu-24.04
-    env:
-      # np reads the key from NULLPLATFORM_API_KEY; supply it via the
-      # ARTIFACT_NP_API_KEY repository secret.
-      NULLPLATFORM_API_KEY: ${{ secrets.ARTIFACT_NP_API_KEY }}
-      # Owner NRN for the artifact (repository/organization variable). Making it
-      # globally visible additionally requires artifact permissions org-wide.
-      NP_ARTIFACT_NRN: ${{ vars.NP_ARTIFACT_NRN }}
-    steps:
-      - name: Install np CLI (alpha-packages build)
-        run: curl -s https://cli.nullplatform.com/install.sh | VERSION=alpha-packages sh
-
-      - name: Register scopes-lambda image artifact (visible to everyone)
-        run: |
-          np artifact create \
-            --nrn "$NP_ARTIFACT_NRN" \
-            --type oci_image \
-            --registry public.ecr.aws \
-            --repository nullplatform/scopes/lambda \
-            --digest "${{ needs.publish.outputs.image_digest }}" \
-            --visible-to "organization=*"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8a65e73..5057b35 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,15 +1,43 @@
 name: release
 
+# Full release pipeline in ONE chained run: release-please -> docker build+push
+# to ECR Public -> np artifact registration -> release finalized with the
+# artifact metadata (image, digest, pinned reference, artifact id) and
+# force-published.
+#
+# Chained on purpose: release-please creates tags with GITHUB_TOKEN, and
+# GitHub never triggers workflows from bot-token events — a separate
+# `on: push: tags` publish workflow does not fire (and the delete/re-push
+# workaround flips the release to Draft).
+#
+# Recovery / backfill: run this workflow manually with existing_tag to
+# publish + finalize a tag that already exists (a release whose publish
+# failed, or a pre-pipeline tag with no artifact metadata).
 on:
   push:
     branches:
       - main
+  workflow_dispatch:
+    inputs:
+      existing_tag:
+        description: 'Publish + finalize an existing tag (recovery/backfill)'
+        required: true
+        type: string
 
 permissions:
   contents: write
   pull-requests: write
+  id-token: write   # OIDC auth against AWS for the ECR push
 
 jobs:
   release:
-    uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main
-    secrets: inherit
+    uses: nullplatform/actions-nullplatform/.github/workflows/release-publish-oci.yml@main
+    with:
+      image_name: scopes/lambda
+      # Same behavior as the previous release.yml caller (shared defaults).
+      release-type: terraform-module
+      update_readme_versions: true
+      existing_tag: ${{ inputs.existing_tag || '' }}
+    secrets:
+      aws_role_arn: ${{ secrets.AWS_ROLE_ARN_ECR_PUSH }}
+      artifact_np_api_key: ${{ secrets.ARTIFACT_NP_API_KEY }}