diff --git a/release.fish b/release.fish
index ec5ffb1..0297b36 100755
--- a/release.fish
+++ b/release.fish
@@ -8,7 +8,7 @@ function __release_git_format_usage
     echo "Usage: release.fish [--from <stage>] [--only <stage>] [--help]
 
 Stages (run in order):
-    tag       Compute next version, create and push annotated tag
+    tag       Compute next version, create and push signed annotated tag
     build     Cross-compile for all release targets
     pack      Compress Linux binaries with UPX
     upload    Upload artifacts via release(1)
@@ -42,6 +42,9 @@ set -l pack_targets \
     linux-amd64 \
     linux-arm64
 
+set -l module_path secluded.site/git-format
+set -l remote origin
+
 # Global so __should_run can see them. Prefixed to avoid collisions.
 set -g __rgf_stages tag build pack upload
 set -g __rgf_from ""
@@ -115,26 +118,36 @@ end
 set -l tag
 
 if __should_run tag
-    # --- Guards ---
+    # --- Fetch and guards ---
 
-    set -l branch (git symbolic-ref --short HEAD)
-    if test "$branch" != main -a "$branch" != dev
-        echo "Error: not on main or dev branch (on $branch)" >&2
+    jj git fetch --remote $remote; or begin
+        echo "Error: fetch failed" >&2
         exit 1
     end
 
-    if test (git status --porcelain=2 | wc -l) -ne 0
-        echo "Error: git working tree is dirty" >&2
+    # In jj the working copy is always a draft commit; release the
+    # parent only when it is the exact commit published as origin/main.
+    if test -z "$(jj log -r '@- & main & main@origin' --no-graph -T commit_id)"
+        echo "Error: working-copy parent is not synchronized with origin/main" >&2
         exit 1
     end
 
-    # --- Fetch tags ---
-
-    git fetch soft --tags
+    if test -n "$(jj diff --summary)"
+        echo "Error: working copy has uncommitted changes" >&2
+        exit 1
+    end
 
     # --- Compute next version ---
 
-    set -l current (git describe --tags --abbrev=0 2>/dev/null; or echo v0.0.0)
+    # jj tag list output is "<tag>: <hash> <desc>"; extract the tag name.
+    set -l current (jj tag list 2>/dev/null \
+        | awk '{print $1}' \
+        | string replace -r ':$' '' \
+        | sort -V \
+        | tail -1)
+    if test -z "$current"
+        set current v0.0.0
+    end
     set -l bump (gum choose major minor patch prerelease)
 
     # Detect whether the current tag is already a prerelease
@@ -216,14 +229,14 @@ if __should_run tag
 
     # --- Tag and push ---
 
-    git tag -a $tag; or begin
+    set -l target (jj log -r @- --no-graph -T commit_id)
+    git tag --sign --annotate $tag $target; or begin
         echo "Error: tagging failed" >&2
         exit 1
     end
 
-    git push origin $tag; or begin
-        echo "Error: tag push failed — deleting local tag" >&2
-        git tag -d $tag 2>/dev/null
+    git push $remote refs/tags/$tag; or begin
+        echo "Error: tag push failed; local tag $tag remains" >&2
         exit 1
     end
 
@@ -231,7 +244,7 @@ if __should_run tag
 
     # --- Notify Go module proxy ---
 
-    go list -m secluded.site/git-format@$tag >/dev/null; or begin
+    go list -m $module_path@$tag >/dev/null; or begin
         echo "Warning: module proxy notification failed" >&2
     end
 else