diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e748c39e1..d383cd856 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,9 +2,9 @@ name: Build
 
 on:
   workflow_dispatch:
-  release:
-    types:
-      - published
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
 
 env:
   ELECTRON_CACHE: $HOME/.cache/electron
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0b5242f18..7816af38e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,13 +6,25 @@ on:
 jobs:
   release:
     name: Release
+
+    # specify the environment to select the right env variables
+    environment: build
+
     runs-on: ubuntu-18.04
+
+    if: "!contains(github.event.head_commit.message, 'chore(release)')"
+
     steps:
       - name: Checkout
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
 
+          # required to use our own personal access token
+          # we need to use a custom PAT as other workflows
+          # aren't triggered using secrets.GITHUB_TOKEN
+          persist-credentials: false
+
       - name: Setup Node.js
         uses: actions/setup-node@v1
         with:
@@ -26,6 +38,6 @@ jobs:
 
       - name: Release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
         run: npx semantic-release