diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
deleted file mode 100644
index e71f4fa5b..000000000
--- a/.github/workflows/publish.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      semver:
-        description: Semver bump type
-        required: true
-      preid:
-        description: Pre ID
-        required: true
-        default: alpha
-      append:
-        description: Additional options
-
-jobs:
-  publish:
-    environment: release
-    runs-on: ubuntu-latest
-    env:
-      NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTOMATION_TOKEN }}
-
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          ref: master
-          fetch-depth: 0
-          token: ${{ secrets.BOT_PAT }}
-          
-      - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@v5
-        with:
-          gpg_private_key: ${{ secrets.BOT_GPG_KEY }}
-          passphrase: ${{ secrets.BOT_GPG_PASSPHRASE }}
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-
-      - name: Setup Node and pnpm
-        uses: silverhand-io/actions-node-pnpm-run-steps@v2
-
-      - name: Configure Git user
-        run: |
-          git config --global user.email bot@silverhand.io
-          git config --global user.name silverhand-bot
-
-      - name: Publish to GitHub
-        # add `no-verify-access` due to https://github.com/lerna/lerna/issues/2788
-        run: |
-          pnpm \
-            --package=conventional-changelog-conventionalcommits \
-            --package=lerna@^5.0.0 \
-            dlx lerna publish \
-            -m "release: %s" \
-            --conventional-commits \
-            --preid=${{ github.event.inputs.preid }} \
-            --no-verify-access \
-            --sign-git-commit \
-            --sign-git-tag \
-            --no-push \
-            --yes \
-            ${{ github.event.inputs.semver }} ${{ github.event.inputs.append }}
-        env:
-          GH_TOKEN: ${{ secrets.BOT_PAT }}
-
-      - name: Push to protected branch
-        uses: CasperWA/push-protected@v2
-        with:
-          token: ${{ secrets.BOT_PAT }}
-          branch: master
-          tags: true
-          timeout: 20
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bb6f3ec1b..9cd076fd6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -104,9 +104,8 @@ jobs:
       - name: Create release pull request
         uses: changesets/action@v1
         with:
-          # Disable temporarily since https://github.com/changesets/changesets/issues/833.
-          # Wait for our customized publish flow.
-          # publish: pnpm changeset tag
+          # Use our customized publish flow. See https://github.com/changesets/changesets/issues/833 for the limit of changesets.
+          publish: node .scripts/publish.js
           commit: 'release: version packages'
           title: 'release: version packages'
           # Create by our rules defined in `/.changeset/README.md`.
@@ -128,15 +127,6 @@ jobs:
       - name: Setup Node and pnpm
         uses: silverhand-io/actions-node-pnpm-run-steps@v2
 
-      - name: Extract changelog
-        run: |
-          git diff HEAD~1 HEAD --exit-code -- CHANGELOG.md | \
-          tail -n +5 | \
-          grep -E "^\+" | \
-          sed -E 's/^\+//' | \
-          cat -s \
-          > /tmp/changelog.txt
-
       - name: Build
         run: pnpm -r build
 
@@ -147,5 +137,5 @@ jobs:
         uses: softprops/action-gh-release@v1
         with:
           token: ${{ secrets.BOT_PAT }}
-          body_path: /tmp/changelog.txt
+          body: <Release notes WIP>
           files: /tmp/logto.tar.gz
diff --git a/.scripts/publish.js b/.scripts/publish.js
index 38324d2b1..45a7396ee 100644
--- a/.scripts/publish.js
+++ b/.scripts/publish.js
@@ -1,6 +1,17 @@
+/**
+ * This script runs the following tasks:
+ * 
+ * 1. Tag main packages defined in `.changeset/config.json` if they are not tagged with the current version in `package.json`;
+ * 2. If no new git tag added, exit;
+ * 3. If at least one new git tag found, run `pnpm -r publish` and `git push --tags`.
+ * 
+ * The subsequential release tasks, such as create GitHub release and build Docker image, will be took over by GitHub workflows.
+ */
+
 const { execSync } = require('child_process');
 const changesetConfig = require('../.changeset/config.json');
 
+const corePackageName = '@logto/core';
 /** @type {Array<{ name: string; version?: string; path: string; private: boolean; }>} */
 const allPackages = JSON.parse(execSync('pnpm recursive list --depth=-1 --json', { encoding: 'utf8' }));
 const mainPackages = [...changesetConfig.fixed, ...changesetConfig.linked].map(([first]) => first);
@@ -28,6 +39,13 @@ const taggedPackages = mainPackages
 
     execSync(`git tag -a ${tag} -m'${tag}'`);
     console.log(`Tag ${tag} added`);
+
+    if (packageName === corePackageName) {
+      const semver = 'v' + version;
+      execSync(`git tag -a ${semver} -m'${semver}'`);
+      console.log(`Tag ${semver} added (SemVer of core package ${corePackageName})`);
+    }
+
     return packageName;
   })
   .filter((value) => !!value);