diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0ff58ac8..86547abd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,6 +20,9 @@ jobs:
 
     environment: release
 
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+
     permissions:
       contents: write
       id-token: write
@@ -61,6 +64,18 @@ jobs:
             echo "dry_run=${{ inputs.dry-run }}" >> $GITHUB_OUTPUT
           fi
 
+      - name: Determine version
+        id: version
+        if: steps.mode.outputs.dry_run != 'true'
+        run: |
+          VERSION=$(pnpm exec release-it --release-version --ci 2>/dev/null) || true
+          if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "version=$VERSION" >> $GITHUB_OUTPUT
+            echo "Next version: $VERSION"
+          else
+            echo "No releasable version detected"
+          fi
+
       - name: Release
         run: |
           if [ "${{ steps.mode.outputs.dry_run }}" == "true" ]; then
@@ -70,3 +85,43 @@ jobs:
           fi
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  sync-template:
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+
+    needs: release
+    # in case a dry run is performed, the version is not set so we need to check for it.
+    if: needs.release.outputs.version != ''
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Sync template and push tag
+        run: pnpm exec tsx tools/publish-template-tag.ts ${{ needs.release.outputs.version }}
diff --git a/.release-it.json b/.release-it.json
index 9007a67a..32c8f9fa 100644
--- a/.release-it.json
+++ b/.release-it.json
@@ -22,7 +22,7 @@
   "hooks": {
     "after:bump": "tsx tools/sync-versions.ts ${version} && pnpm build:notice && git add NOTICE.md",
     "before:release": "pnpm build && pnpm --filter=docs build && pnpm --filter=@databricks/appkit dist && pnpm --filter=@databricks/appkit-ui dist",
-    "after:release": "npm publish packages/appkit/tmp --access public --provenance && npm publish packages/appkit-ui/tmp --access public --provenance && tsx tools/publish-template-tag.ts ${version}"
+    "after:release": "npm publish packages/appkit/tmp --access public --provenance && npm publish packages/appkit-ui/tmp --access public --provenance"
   },
   "plugins": {
     "@release-it/conventional-changelog": {
diff --git a/tools/publish-template-tag.ts b/tools/publish-template-tag.ts
index 0fe759c4..569be6d5 100644
--- a/tools/publish-template-tag.ts
+++ b/tools/publish-template-tag.ts
@@ -1,7 +1,8 @@
 #!/usr/bin/env tsx
 /**
- * Run after npm publish. Syncs the template to the new version (with retry),
- * then commits, tags template-vX.X.X, and pushes.
+ * Syncs the template to the given version (with retry), then commits, tags
+ * template-vX.X.X, and pushes. Used by the Release workflow (sync-template job
+ * in .github/workflows/release.yml) and for manual runs.
  */
 
 import { spawnSync } from "node:child_process";
@@ -75,7 +76,7 @@ if (installExit !== 0) {
 // 3. Git add, commit, tag, push
 const commands: [string, string[]][] = [
   ["git", ["add", "template/package.json", "template/package-lock.json"]],
-  ["git", ["commit", "-m", `chore: sync template to v${version}`]],
+  ["git", ["commit", "-m", `chore: sync template to v${version} [skip ci]`]],
   ["git", ["tag", `template-v${version}`]],
   ["git", ["push", "origin", "main", "--follow-tags"]],
 ];