diff --git a/.github/release-notes/v2.1.1.md b/.github/release-notes/v2.1.1.md
new file mode 100644
index 0000000..82f58e0
--- /dev/null
+++ b/.github/release-notes/v2.1.1.md
@@ -0,0 +1,10 @@
+## NVENCForgeGUI 2.1.1: built on GitHub, ready for code signing
+
+The window works exactly as in 2.1.0. This release is about where the exe comes from.
+
+- **Built by GitHub Actions:** from this version on, `NVENCForgeGUI.exe` is built and published by GitHub Actions from the source in this repository, no longer on the developer's PC. The tests and window checks run before every release, and a dry run checks the whole build without publishing anything.
+- **File properties:** the exe shows its name and version under right-click > Properties > Details.
+- **Code signing prepared:** free code signing through the SignPath Foundation is applied for. Until it is active the exe stays unsigned. What would be signed and what the window fetches from GitHub (only when you click for it): [code signing policy](https://github.com/burnersen/NVENCForgeGUI/blob/main/CODE_SIGNING.md).
+- **License:** GPL-3.0-only, and nothing else.
+
+Update: About page > *Check for updates*, or replace `NVENCForgeGUI.exe` with the new one. Your converter, settings and profiles in `tools` stay.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5b34b3..ab78d0a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Existing tag to release (for example v2.2.0)'
+        description: 'Version to release, e.g. v2.2.0: an existing tag is built as it is, a new one is built from main and tagged'
         required: true
       dry_run:
         description: 'Dry run: build and check only, sign and publish nothing'
@@ -58,7 +58,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.tag || github.ref }}
           # The annotated tag message can be the release text, and it only
           # exists in a clone that carries the tag objects.
           fetch-depth: 0
@@ -68,6 +67,26 @@ jobs:
           go-version-file: go.mod
           cache: true
 
+      # Started by hand: an existing tag is built exactly as tagged. A new
+      # version is built from main, and publishing the release creates its
+      # tag on the commit that was built.
+      - name: Commit to build
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          git rev-parse -q --verify "refs/tags/$env:RELEASE_TAG" *> $null
+          if ($LASTEXITCODE -eq 0) {
+            git checkout -q --detach "refs/tags/$env:RELEASE_TAG"
+            Write-Host "Building the existing tag $env:RELEASE_TAG."
+          } elseif ($env:GITHUB_REF_NAME -ne 'main' -and $env:DRY_RUN -ne 'true') {
+            Write-Host "::error::A new version is released from main only, not from $env:GITHUB_REF_NAME."
+            exit 1
+          } else {
+            Write-Host "Tag $env:RELEASE_TAG does not exist yet: building $env:GITHUB_REF_NAME, the release creates the tag."
+          }
+          $global:LASTEXITCODE = 0
+
       # Node only runs the window checks; the interface itself has no build step.
       - uses: actions/setup-node@v4
         with:
@@ -239,5 +258,5 @@ jobs:
             gh release edit $tag --title $title --notes-file release-notes.md --draft=false
             gh release upload $tag NVENCForgeGUI.exe --clobber
           } else {
-            gh release create $tag NVENCForgeGUI.exe --title $title --notes-file release-notes.md
+            gh release create $tag NVENCForgeGUI.exe --target (git rev-parse HEAD) --title $title --notes-file release-notes.md
           }
diff --git a/main.go b/main.go
index aaebb63..5bd22ec 100644
--- a/main.go
+++ b/main.go
@@ -25,7 +25,7 @@ var assets embed.FS
 // guiVersion ist die einzige Stelle, an der die Version dieses Fensters
 // steht. Angezeigt wird sie im Fensterkopf (Titelleiste) und in der
 // Kopfzeile der Oberfläche selbst (siehe StartupInfo in app.go).
-const guiVersion = "2.1.0"
+const guiVersion = "2.1.1"
 
 // singleInstanceID hält die Startsperre. Der Name muss auf dem Rechner
 // einmalig sein und darf sich nie ändern — sonst erkennt eine neue Ausgabe die
diff --git a/wails.json b/wails.json
index d65a2fc..8f8e2dd 100644
--- a/wails.json
+++ b/wails.json
@@ -8,7 +8,7 @@
   "info": {
     "companyName": "burnersen",
     "productName": "NVENCForgeGUI",
-    "productVersion": "2.1.0",
+    "productVersion": "2.1.1",
     "copyright": "Copyright 2026 burnersen",
     "comments": "A window for NVENCForge"
   }