diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 63b00c7..18fda84 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
 
 permissions:
   contents: write
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
new file mode 100644
index 0000000..8b05089
--- /dev/null
+++ b/.github/workflows/tag-release.yml
@@ -0,0 +1,79 @@
+name: Tag release version
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - build.gradle.kts
+
+permissions:
+  actions: write
+  contents: write
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Create release tag for a version bump
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          version_from_file() {
+            sed -nE 's/^version = "([^"]+)"$/\1/p' "$1" | head -n 1
+          }
+
+          current_version="$(version_from_file build.gradle.kts)"
+          if [[ -z "$current_version" ]]; then
+            echo "Unable to read the project version from build.gradle.kts." >&2
+            exit 1
+          fi
+
+          previous_version=""
+          if git rev-parse "${GITHUB_SHA}^" >/dev/null 2>&1; then
+            previous_file="$(mktemp)"
+            if git show "${GITHUB_SHA}^:build.gradle.kts" > "$previous_file" 2>/dev/null; then
+              previous_version="$(version_from_file "$previous_file")"
+            fi
+            rm -f "$previous_file"
+          fi
+
+          if [[ "$previous_version" == "$current_version" ]]; then
+            echo "Project version did not change ($current_version); no release tag needed."
+            exit 0
+          fi
+
+          tag="v$current_version"
+          git fetch --tags --force
+
+          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+            existing_commit="$(git rev-list -n 1 "$tag")"
+            if [[ "$existing_commit" != "$GITHUB_SHA" ]]; then
+              echo "Tag $tag already exists at $existing_commit, not $GITHUB_SHA." >&2
+              exit 1
+            fi
+            echo "Tag $tag already points to this release commit."
+          else
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git tag -a "$tag" -m "WorkflowGuard $current_version" "$GITHUB_SHA"
+            git push origin "$tag"
+          fi
+
+          if gh release view "$tag" >/dev/null 2>&1; then
+            echo "Release $tag already exists; nothing to dispatch."
+            exit 0
+          fi
+
+          gh workflow run release.yml --ref "$tag"
+          echo "Dispatched release.yml for $tag."
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 77bff49..662d216 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## Unreleased
+## 0.3.4 - 2026-09-24
 
 ### Security
 
@@ -11,8 +11,9 @@
 
 ### Changed
 
-- Add a tag-driven release workflow that requires the tag version to match the
-  Gradle project version and publishes the same verified JAR/checksum pair.
+- Add automatic annotated release tagging for version bumps on `main` plus a
+  tag-driven release workflow that requires the tag version to match the Gradle
+  project version and publishes the same verified JAR/checksum pair.
 - Document the `0.3.3` validation-build versus release-asset checksum
   discrepancy so historical evidence is not mistaken for the attached binary.
 - Refresh the BApp Store readiness review against PortSwigger's
diff --git a/README.md b/README.md
index d39b677..d4131f7 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 WorkflowGuard is a state-aware workflow mutation engine for Burp Suite. It captures a legitimate multi-step HTTP process, generates controlled out-of-order variants, and is designed to detect business-logic violations by comparing application state before and after execution.
 
 > [!IMPORTANT]
-> The repository contains the complete `0.3.3` local MVP described in the roadmap. The intentionally excluded items remain listed under **Explicitly out of the MVP** in the roadmap.
+> The repository contains the complete `0.3.4` local MVP described in the roadmap. The intentionally excluded items remain listed under **Explicitly out of the MVP** in the roadmap.
 
 ## What makes WorkflowGuard different
 
@@ -60,8 +60,9 @@ state.
 
 The project includes the Gradle Wrapper, so a separate Gradle installation is not required.
 
-WorkflowGuard `0.3.3` has been exercised end-to-end on Burp Suite Community
-Edition `2026.7.1`. Community can load and run the extension, but Burp reserves
+WorkflowGuard's runtime behavior was exercised end-to-end on Burp Suite Community
+Edition `2026.7.1` during the `0.3.3` validation campaign. Version `0.3.4` is a
+release-hardening update with no intended workflow-execution behavior changes. Community can load and run the extension, but Burp reserves
 project files and the **All issues** viewer for Professional. WorkflowGuard
 therefore keeps full run evidence in its own tab, supports redacted JSON and
 portable workflow exports, and labels Burp issue publication as **Pro viewer
@@ -85,7 +86,7 @@ On Linux or macOS:
 The loadable extension is produced at:
 
 ```text
-build/libs/workflowguard-0.3.3.jar
+build/libs/workflowguard-0.3.4.jar
 ```
 
 ## Load in Burp Suite
@@ -129,6 +130,7 @@ See [Development workflow](docs/development.md),
 [authenticated laboratory validation](docs/ui-authenticated-validation-20260730.md),
 [BApp readiness matrix](docs/bapp-readiness.md),
 [BApp submission text](docs/bapp-submission.md),
+[0.3.4 release notes](docs/release-notes-0.3.4.md),
 [0.3.3 release notes](docs/release-notes-0.3.3.md),
 [release integrity process](docs/release-integrity.md),
 [Invariant language](docs/invariants.md),
diff --git a/build.gradle.kts b/build.gradle.kts
index d30677c..e96f812 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -3,7 +3,7 @@ plugins {
 }
 
 group = "dev.workflowguard"
-version = "0.3.3"
+version = "0.3.4"
 
 repositories {
     mavenCentral()
diff --git a/docs/bapp-readiness.md b/docs/bapp-readiness.md
index 92fcc5a..f341802 100644
--- a/docs/bapp-readiness.md
+++ b/docs/bapp-readiness.md
@@ -6,7 +6,7 @@ PortSwigger criteria revision checked: 2026-09-22
 
 ## Verdict
 
-WorkflowGuard `0.3.3` continues to satisfy the current technical BApp Store
+WorkflowGuard `0.3.4` continues to satisfy the current technical BApp Store
 acceptance criteria. The source repository is public and suitable for
 PortSwigger review.
 
@@ -35,7 +35,7 @@ extension-portal issue form.
 
 - Clean JDK 21 build:
   `.\gradlew.bat clean test jar --no-daemon --rerun-tasks`.
-- Automated baseline: **88 tests**, zero failures, zero errors, one opt-in
+- Automated baseline for the release line: **88 tests**, zero failures, zero errors, one opt-in
   credential-dependent laboratory test skipped, across 26 test suites.
 - Burp Suite Community Edition `2026.7.1`: direct `0.3.3` UI validation
   confirmed load, portable workflow import, mutation generation, unsafe raw
@@ -70,8 +70,10 @@ The exact final verification commands and UI observations are recorded in
 - Maven Central currently lists Montoya API `2026.7`, which remains the
   compile-time API used by WorkflowGuard.
 - Direct runtime/UI validation evidence in this repository remains against
-  Burp Suite Community Edition `2026.7.1`. This document does not claim a
-  completed direct `2026.9` regression campaign.
+  Burp Suite Community Edition `2026.7.1` from the `0.3.3` campaign. Version
+  `0.3.4` changes dependency/release hardening and documentation, not the
+  workflow execution semantics. This document does not claim a completed direct
+  `2026.9` regression campaign.
 
 ## Submission fields
 
diff --git a/docs/bapp-submission.md b/docs/bapp-submission.md
index e0377d5..e332755 100644
--- a/docs/bapp-submission.md
+++ b/docs/bapp-submission.md
@@ -13,7 +13,7 @@ cleanup.
 ## Current extension-portal form
 
 - **Extension URL:** `https://github.com/aleff-github/WorkflowGuard`
-- **Version number:** `0.3.3`
+- **Version number:** `0.3.4`
 - **Additional compatible products and features:** select **Community** only.
   Professional is included automatically; WorkflowGuard does not claim DAST or
   Burp AI integration.
@@ -58,7 +58,7 @@ viewer and persistent project files are Professional-only.
 ## Installation
 
 1. Build with `./gradlew clean test jar`, or install the published BApp.
-2. For a manual build, load `build/libs/workflowguard-0.3.3.jar` as a Java
+2. For a manual build, load `build/libs/workflowguard-0.3.4.jar` as a Java
    extension under **Extensions → Installed**.
 3. Open the **WorkflowGuard** suite tab.
 
@@ -79,7 +79,7 @@ systems they own or are authorized to assess.
 
 - Java 21
 - Montoya API `2026.7`
-- Validated with Burp Suite Community Edition `2026.7.1`
+- Runtime/UI behavior validated with Burp Suite Community Edition `2026.7.1` during the `0.3.3` campaign; `0.3.4` contains release/security hardening with no intended workflow-execution behavior changes
 - Dependencies bundled in the release JAR
 - GPL-3.0-only
 - Offline operation; no telemetry or cloud dependency
diff --git a/docs/release-integrity.md b/docs/release-integrity.md
index fb31f76..3ed02cf 100644
--- a/docs/release-integrity.md
+++ b/docs/release-integrity.md
@@ -9,17 +9,22 @@ the release notes all refer to the same build.
 1. Update the Gradle project version and create matching
    `docs/release-notes-X.Y.Z.md`.
 2. Merge all intended changes to `main` and require a green Build workflow.
-3. Create and push the annotated tag `vX.Y.Z` from the exact release commit.
-4. Do not create the GitHub release manually before pushing the tag.
-5. Let `.github/workflows/release.yml` build, test, verify, checksum, and
-   publish the release artifacts.
+3. A version change in `build.gradle.kts` on `main` triggers
+   `.github/workflows/tag-release.yml`, which creates the annotated
+   `vX.Y.Z` tag at that exact release commit.
+4. Do not create the GitHub release manually.
+5. The tag workflow explicitly dispatches `.github/workflows/release.yml`
+   after creating the tag. Manually pushed release tags can also trigger the
+   release workflow directly. The release workflow builds, tests, verifies,
+   checksums, and publishes the release artifacts.
 6. Download the published JAR and `.sha256` file and verify them independently
    before submitting or updating the BApp Store entry.
 
-The release workflow fails if the tag version does not match the Gradle project
-version, if more than one WorkflowGuard JAR is produced, if Montoya API classes
-are bundled, if duplicate JAR entries are present, or if release notes are
-missing.
+The tag workflow only creates a release tag when the project version actually
+changes. The release workflow fails if the tag version does not match the Gradle
+project version, if more than one WorkflowGuard JAR is produced, if Montoya API
+classes are bundled, if duplicate JAR entries are present, or if release notes
+are missing.
 
 ## Historical correction for 0.3.3
 
@@ -40,5 +45,6 @@ These are different binary builds. The July validation checksum must therefore
 not be used to verify the currently attached release asset. The release page
 body should be corrected manually to remove the stale size and checksum.
 
-Starting with the next release, the release workflow is the canonical producer
-of both the JAR and its checksum.
+Starting with `0.3.4`, the automated tag/release workflows are the canonical
+release path and the release workflow is the canonical producer of both the JAR
+and its checksum.
diff --git a/docs/release-notes-0.3.4.md b/docs/release-notes-0.3.4.md
new file mode 100644
index 0000000..75c845d
--- /dev/null
+++ b/docs/release-notes-0.3.4.md
@@ -0,0 +1,47 @@
+# WorkflowGuard 0.3.4
+
+WorkflowGuard `0.3.4` is a release-integrity and security-maintenance release
+prepared for BApp Store submission. It intentionally avoids changing the core
+workflow-execution semantics validated in the `0.3.3` campaign.
+
+## Security and dependency maintenance
+
+- Update Jackson Databind and aligned Jackson runtime components to `2.22.3`.
+- Keep Gradle dependency locking enabled.
+- Use Gradle Wrapper `9.7.1` with a pinned distribution checksum.
+- Update `actions/setup-java` to the pinned `6.0.1` commit.
+
+## Release integrity
+
+- Verify the distributable JAR in CI.
+- Reject a build if Montoya API classes are accidentally bundled.
+- Reject duplicate JAR entries.
+- Generate and verify a SHA-256 file from the exact built artifact.
+- Add automatic annotated tagging when the Gradle project version changes on
+  `main`.
+- Add a tag-driven release workflow that requires the Git tag and Gradle
+  project version to match.
+- Publish the same verified JAR/checksum pair produced by the release workflow.
+- Document the historical `0.3.3` validation-build versus release-asset
+  checksum discrepancy.
+
+## BApp Store preparation
+
+- Refresh the BApp Store readiness assessment against PortSwigger's
+  2026-09-22 acceptance criteria.
+- Update the submission text and explicitly distinguish WorkflowGuard from
+  Sequence Comparer, AuthMatrix, Autorize, Auth Analyzer, and API Workflow
+  Manager.
+- Keep Community compatibility declared; no DAST or Burp AI integration is
+  claimed.
+
+## Validation
+
+- The release candidate is built and tested by GitHub Actions on JDK 21.
+- The CI pipeline verifies the final JAR layout and checksum generation.
+- Direct runtime/UI evidence remains the Burp Suite Community Edition
+  `2026.7.1` campaign performed for `0.3.3`; `0.3.4` does not intentionally
+  alter workflow execution behavior.
+
+The canonical binary checksum for `0.3.4` is generated automatically by the
+release workflow and published alongside the JAR.