diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 753c3ef..48887d5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,7 +4,15 @@ on:
   push:
     tags:
       - 'v*.*.*'
+  # Manual runs rebuild the assets of an existing release: pass its tag
+  # and the job uploads into that release instead of one named after the
+  # branch. Used when a leg failed after the tag was pushed.
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing release tag to (re)build assets for, e.g. v1.0.0'
+        required: true
+        type: string
 
 permissions:
   contents: write
@@ -36,7 +44,11 @@ jobs:
           # Intel .dmg — where Playwright looked for `chrome-mac-x64`,
           # found nothing, and every Intel user landed on the "browser
           # missing" dialog. Each job now downloads the browsers for the
-          # architecture it is packaging.
+          # architecture it is packaging. The `--arm64` / `--x64` flag is
+          # the ONLY place the arch is chosen: electron-builder.yml must not
+          # list `mac.target[].arch`, or the config list silently overrides
+          # the flag and each leg builds both images again (that is what
+          # broke 1.0.0's first run).
           #
           # Each leg also names its .dmg with the words a user actually
           # knows ("Apple-Silicon" / "Intel") instead of arm64 / x64.
@@ -140,6 +152,7 @@ jobs:
       - name: Publish GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ inputs.tag || github.ref_name }}
           files: ${{ matrix.artifact_paths }}
           generate_release_notes: true
           draft: false
diff --git a/README.md b/README.md
index f7b532a..274fd0e 100644
--- a/README.md
+++ b/README.md
@@ -226,11 +226,11 @@ node apps/cli/dist/index.js analyze-logs access_log-Jul.gz              # gzippe
 ```bash
 npm run build                                  # all packages + desktop + CLI
 npm --workspace apps/desktop run build:win     # Windows installer (NSIS) + portable .exe
-npm --workspace apps/desktop run build:mac     # macOS DMG (arm64 + x64)
+npm --workspace apps/desktop run build:mac     # macOS DMG for this Mac's CPU (add -- --arm64 --x64 for both)
 npm --workspace apps/desktop run build:linux   # AppImage / .deb / .rpm
 ```
 
-A local `build:mac` names the images `-macOS-arm64.dmg` / `-macOS-x64.dmg`; the release workflow builds each architecture on its own runner and renames them to `-macOS-Apple-Silicon.dmg` / `-macOS-Intel.dmg`.
+A local `build:mac` names the image `-macOS-arm64.dmg` or `-macOS-x64.dmg`; the release workflow builds each architecture on its own runner and names them `-macOS-Apple-Silicon.dmg` / `-macOS-Intel.dmg`.
 
 </details>
 
diff --git a/apps/desktop/electron-builder.yml b/apps/desktop/electron-builder.yml
index 90736fc..54876b0 100644
--- a/apps/desktop/electron-builder.yml
+++ b/apps/desktop/electron-builder.yml
@@ -65,11 +65,16 @@ portable:
   artifactName: FreeCrawl-SEO-Tool-${version}-Windows-Portable.${ext}
 mac:
   artifactName: FreeCrawl-SEO-Tool-${version}-macOS-${arch}.${ext}
+  # No `arch` list here on purpose. electron-builder lets a config-side
+  # arch list override the CLI's `--arm64` / `--x64` unless a target type
+  # is also given on the CLI (computeArchToTargetNamesMap), so with
+  # `arch: [arm64, x64]` every release leg built BOTH images — and once
+  # both carried the same friendly name they overwrote each other. The
+  # arch now comes from the CLI: the release workflow passes one per leg,
+  # a local `npm run build:mac` builds the host arch, and
+  # `npm run build:mac -- --arm64 --x64` builds both.
   target:
-    - target: dmg
-      arch:
-        - arm64
-        - x64
+    - dmg
   category: public.app-category.developer-tools
 linux:
   executableName: freecrawl-seo