diff --git a/.github/workflows/sign.yml b/.github/workflows/sign.yml
index df9476b..0ebb261 100644
--- a/.github/workflows/sign.yml
+++ b/.github/workflows/sign.yml
@@ -2,13 +2,18 @@ name: Sign installers
 
 on:
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag name (e.g. v1.2.3). If empty, will use latest.'
+        required: false
+        default: ''
   workflow_run:
     workflows: ["Builder main installer"]
     types: [completed]
 
 permissions:
-  contents: read      # para descargar assets de release
-  id-token: write     # para OIDC keyless
+  contents: read
+  id-token: write
 
 jobs:
   sign:
@@ -16,12 +21,28 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Determine release tag
+        id: tag
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const inputTag = '${{ github.event.inputs.tag }}';
+            if (inputTag) return inputTag;
+            if (context.eventName === 'workflow_run') {
+              return context.payload.workflow_run.event.release.tag_name;
+            }
+            const latest = await github.rest.repos.getLatestRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo
+            });
+            return latest.data.tag_name;
+
       - name: Download release assets
         uses: repo-sync/download-release@v2
         with:
           owner: ${{ github.repository_owner }}
           repo: ${{ github.repository }}
-          tag: ${{ github.event.workflow_run.event.release.tag_name }}
+          tag: ${{ steps.tag.outputs.result }}
           pattern: '*.exe'
 
       - name: Install cosign