diff --git a/.github/workflows/manual-release.yml b/.github/workflows/manual-release.yml
new file mode 100644
index 000000000..febc89db1
--- /dev/null
+++ b/.github/workflows/manual-release.yml
@@ -0,0 +1,46 @@
+name: CD-manual-release
+
+# Most releases should go through the regular release workflow.
+# Manual releases are only useful for maintenance releases, because
+# they need an explicit tag to be applied to bypass the default 'latest'.
+on:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: "Commit (SHA, branch or tag) to publish from"
+        required: true
+        type: string
+      tag:
+        description: "npm dist-tag to apply (e.g. release-4.0.1)"
+        required: true
+        type: string
+
+# Getting an ID token is required for NPMJS trusted publishers
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+
+env:
+  CI: true
+jobs:
+  publish-npm:
+    runs-on: ubuntu-latest
+    env:
+      DIST_TAG: ${{ inputs.tag }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.commit }}
+      - name: Prepare for publication to npm
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: ".nvmrc"
+          registry-url: "https://registry.npmjs.org"
+          cache: npm
+      # Ensure npm 11.5.1 or later for trusted publishing
+      - run: npm install -g npm@latest
+      - run: npm ci
+      - run: npm publish --workspace packages/core --tag "$DIST_TAG"
+      - run: npm publish --workspace packages/node --tag "$DIST_TAG"
+      - run: npm publish --workspace packages/oidc-browser --tag "$DIST_TAG"
+      - run: npm publish --workspace packages/browser --tag "$DIST_TAG"