diff --git a/.github/workflows/pages.yaml b/.github/workflows/pages.yaml
new file mode 100644
index 00000000..7ee597bb
--- /dev/null
+++ b/.github/workflows/pages.yaml
@@ -0,0 +1,36 @@
+---
+# This workflow runs when PRs are merged and tags/builds/publishes a release.
+
+# Run when PRs to main are closed.
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+name: Build and publish a release
+
+jobs:
+  github-pages:
+    name: Publish user manual to GitHub Pages
+    runs-on: ubuntu-latest
+    steps:
+      - uses: cachix/install-nix-action@v22
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+          extra_nix_config: |
+            extra-experimental-features = nix-command flakes
+            accept-flake-config = true
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Build user manual
+        run: |
+          RESULT=$(nix build --no-link --print-out-paths --print-build-logs .#ghciwatch.user-manual)
+          cp -r "$RESULT/share/ghciwatch/html-manual" ghciwatch-user-manual
+
+      - name: Publish to GitHub Pages
+        uses: JamesIves/github-pages-deploy-action@v4
+        with:
+          folder: ghciwatch-user-manual/
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 4739d848..b5e9c1c3 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -206,38 +206,3 @@ jobs:
             [Release ${{ needs.version.outputs.version }}][release] was built and published successfully!
 
             [release]: ${{ steps.create_release.outputs.url }}
-
-  github-pages:
-    name: Publish user manual to GitHub Pages
-    runs-on: ubuntu-latest
-    needs:
-      - build
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Download artifacts
-        # This downloads the uploaded artifacts to the current directory; the
-        # path format for downloaded artifacts is `{name}/{basename}`, where
-        # `{basename}` is the basename of the upload `path`.
-        #
-        # For example, the following artifact:
-        #
-        #     - uses: actions/upload-artifact@v3
-        #       with:
-        #         name: linux
-        #         path: target/release/ghciwatch-aarch64-linux
-        #
-        # will be downloaded to `linux/ghciwatch-aarch64-linux`.
-        uses: actions/download-artifact@v3
-
-      - name: Extract user manual
-        run: |
-          tar --extract \
-              --verbose \
-              --file linux/ghciwatch-user-manual.tar.xz
-
-      - name: Publish to GitHub Pages
-        uses: JamesIves/github-pages-deploy-action@v4
-        with:
-          folder: ghciwatch-user-manual/
diff --git a/.github/workflows/version.yaml b/.github/workflows/version.yaml
index a4d04680..8bbbd926 100644
--- a/.github/workflows/version.yaml
+++ b/.github/workflows/version.yaml
@@ -96,6 +96,10 @@ jobs:
           #
           # I'd love a better way of implementing this but GitHub doesn't have
           # one: https://github.com/github-community/community/discussions/13836
+          #
+          # Also, PRs created with the default `secrets.GITHUB_TOKEN` won't
+          # trigger `pull_request` workflows, so regular CI won't run either.
+          # See: https://github.com/orgs/community/discussions/65321
           token: ${{ secrets.REPO_GITHUB_TOKEN }}
           branch: release/${{ steps.new_cargo_metadata.outputs.version }}
           delete-branch: true