diff --git a/.github/workflows/publish-python-libraries.yml b/.github/workflows/publish-python-libraries.yml
index 403d501..a5c81d4 100644
--- a/.github/workflows/publish-python-libraries.yml
+++ b/.github/workflows/publish-python-libraries.yml
@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 15
     permissions:
       actions: read
-      contents: read
+      contents: write
       packages: read
       id-token: write
     defaults:
@@ -55,24 +55,32 @@ jobs:
           echo "FAILURE_REASON=missing_artifact" >> $GITHUB_ENV
           exit 1
 
-      - name: download build artifact
-        if: ${{ inputs.artifact_path != '' && steps.check_artifact_exists.outputs.exists == 'true' }}
-        uses: actions/download-artifact@v8
-        with:
-          name: build
-          path: ${{ inputs.artifact_path }}
-
-      - uses: astral-sh/setup-uv@v7
-        if: ${{ success() }}
-        with:
-          enable-cache: true
-          cache-dependency-glob: "${{ inputs.root_dir }}/uv.lock"
-
-      - uses: actions/setup-python@v6
-        if: ${{ success() && hashFiles('pyproject.toml') != '' }}
-        with:
-          python-version-file: "pyproject.toml"
+      - name: extract version from pyproject.toml
+        if: ${{ steps.check_artifact_exists.outputs.exists == 'true' }}
+        id: extract_version
+        run: |
+          if [[ -f pyproject.toml ]]; then
+            VERSION=$(grep -m1 '^version' pyproject.toml | cut -d'"' -f2)
+          else
+            echo "::error::[PyPI] Cannot find pyproject.toml"
+            exit 1
+          fi
+          if [[ -z "${VERSION}" || "${VERSION}" == "null" ]]; then
+            echo "::error::[PyPI] Could not extract version from pyproject.toml (got: '${VERSION}')"
+            exit 1
+          fi
+          echo "release_tag=v${VERSION}" >> $GITHUB_OUTPUT
+          echo "::notice::[PyPI] Extracted version: v${VERSION}"
 
-      - name: publish to pypi
-        if: ${{ success() }}
-        run: uv publish
+      - name: set git tag if not yet set
+        if: ${{ steps.check_artifact_exists.outputs.exists == 'true' }}
+        run: |
+          if git ls-remote --tags origin "${{ steps.extract_version.outputs.release_tag }}" | grep -q "${{ steps.extract_version.outputs.release_tag }}"; then
+            echo "::notice::[PyPI] Tag ${{ steps.extract_version.outputs.release_tag }} already exists, skipping"
+          else
+            git tag "${{ steps.extract_version.outputs.release_tag }}"
+            git push origin "${{ steps.extract_version.outputs.release_tag }}"
+            echo "::notice::[PyPI] Created and pushed tag ${{ steps.extract_version.outputs.release_tag }}"
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release-github.yml b/.github/workflows/release-github.yml
index df98f48..8d85ea4 100644
--- a/.github/workflows/release-github.yml
+++ b/.github/workflows/release-github.yml
@@ -56,21 +56,17 @@ jobs:
         run: |
           if [[ "${{ inputs.tool }}" == "npm" || "${{ inputs.tool }}" == "yarn" ]]; then
             VERSION=$(jq -r .version package.json)
-            echo "RELEASE_TAG=v${VERSION}" >> $GITHUB_ENV
           elif [[ "${{ inputs.tool }}" == "uv" ]]; then
             if [[ -f pyproject.toml ]]; then
               VERSION=$(grep -m1 '^version' pyproject.toml | cut -d'"' -f2)
-              echo "RELEASE_TAG=v${VERSION}" >> $GITHUB_ENV
             elif [[ -f "${{ inputs.artifact_path }}/version.json" ]]; then
               VERSION=$(jq -r .version "${{ inputs.artifact_path }}/version.json")
-              echo "RELEASE_TAG=v${VERSION}" >> $GITHUB_ENV
             else
               echo "::error::[Release] Cannot find pyproject.toml or version.json for uv project"
               exit 1
             fi
           elif [[ "${{ inputs.tool }}" == "cargo" ]]; then
             VERSION=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2)
-            echo "RELEASE_TAG=v${VERSION}" >> $GITHUB_ENV
           else
             echo "::error::[Release] Unsupported tool '${{ inputs.tool }}' for automatic version extraction"
             echo "::error::[Release] Supported tools: npm, yarn, uv, cargo"
@@ -81,14 +77,15 @@ jobs:
             echo "::error::[Release] Could not extract version from manifest (got: '${VERSION}')"
             exit 1
           fi
+          echo "release_tag=v${VERSION}" >> $GITHUB_OUTPUT
           echo "::notice::[Release] Extracted version: v${VERSION}"
 
       - name: check if release already exists
         if: ${{ steps.check_artifact_exists.outputs.exists == 'true' }}
         id: check_release_exists
         run: |
-          if gh release view ${{ env.RELEASE_TAG }} &>/dev/null; then
-            echo "::error::[Release] Release with tag ${{ env.RELEASE_TAG }} already exists"
+          if gh release view ${{ steps.extract_version.outputs.release_tag }} &>/dev/null; then
+            echo "::error::[Release] Release with tag ${{ steps.extract_version.outputs.release_tag }} already exists"
             echo "::error::[Release] Bump the version in the manifest to create a new release"
             exit 3
           fi
@@ -103,8 +100,8 @@ jobs:
         if: ${{ steps.check_artifact_exists.outputs.exists == 'true' }}
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          tag_name: ${{ env.RELEASE_TAG }}
-          name: "Release ${{ env.RELEASE_TAG }}"
+          tag_name: ${{ steps.extract_version.outputs.release_tag }}
+          name: "Release ${{ steps.extract_version.outputs.release_tag }}"
           generate_release_notes: true
           files: |
             ${{ inputs.artifact_path }}/**/*