diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 1ad3f79..31e276a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -1,4 +1,4 @@
-name: "CodeQL"
+name: "CodeQL analysis"
 
 on:
   push:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5fbcf51..3410113 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,13 +3,14 @@ name: Release
 # Tags only, and the tag is the version: the POM keeps its development version, and this workflow sets
 # the tag's before it builds. A release is four numbers, X.Y.Z.N; anything else is refused.
 #
-# Maven Central only. The build stages the plugin with its sources and javadoc in target/staging-deploy,
+# Maven Central first. The build stages the plugin with its sources and javadoc in target/staging-deploy,
 # and JReleaser signs it with the release key, uploads it to the Central Portal and publishes it once the
-# Portal has validated it.
+# Portal has validated it. Then a draft GitHub release on the tag gets the same jar, signed, with a
+# checksum file and the commits since the previous tag; publishing the draft is a click on GitHub.
 #
 # Needs four repository secrets: JRELEASER_MAVENCENTRAL_USERNAME and JRELEASER_MAVENCENTRAL_PASSWORD (the
 # Central Portal user token), JRELEASER_GPG_SECRET_KEY and JRELEASER_GPG_PASSPHRASE. `mise run gh:secrets`
-# sets them from 1Password.
+# sets them from 1Password. The draft release uses the workflow's own GITHUB_TOKEN.
 on:
   push:
     tags:
@@ -59,6 +60,15 @@ jobs:
           JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
           JRELEASER_GPG_PASSPHRASE: ${{ secrets.JRELEASER_GPG_PASSPHRASE }}
 
+      # The jar Maven Central got, so that the GitHub release carries the same file instead of a rebuild.
+      - name: Hand the jar to the GitHub release job
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: plugin-jar
+          path: target/fmt-maven-plugin-${{ github.ref_name }}.jar
+          if-no-files-found: error
+          retention-days: 1
+
       - name: Keep JReleaser's log
         if: ${{ failure() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -67,3 +77,53 @@ jobs:
           path: target/jreleaser/trace.log
           if-no-files-found: ignore
           retention-days: 7
+
+  # A draft GitHub release on the tag, only once the plugin is on Maven Central. JReleaser signs the jar
+  # again with the release key and adds a checksum file and the commits since the previous tag. A re-run
+  # fails while a release for the tag exists.
+  github-release:
+    name: draft GitHub release
+    needs: central
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install JDK 21
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      # The central job has already refused anything but a clean X.Y.Z.N.
+      - name: Take the version from the tag
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: >-
+          mvn --no-transfer-progress -B org.codehaus.mojo:versions-maven-plugin:2.22.0:set
+          -DnewVersion="$VERSION" -DgenerateBackupPoms=false
+
+      - name: Collect the jar Maven Central got
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: plugin-jar
+          path: target
+
+      - name: Open the draft release
+        run: mvn --no-transfer-progress -B -P github-release jreleaser:release
+        env:
+          JRELEASER_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          JRELEASER_GPG_SECRET_KEY: ${{ secrets.JRELEASER_GPG_SECRET_KEY }}
+          JRELEASER_GPG_PASSPHRASE: ${{ secrets.JRELEASER_GPG_PASSPHRASE }}
+
+      - name: Keep JReleaser's log
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: jreleaser-log-github
+          path: target/jreleaser/trace.log
+          if-no-files-found: ignore
+          retention-days: 7
diff --git a/pom.xml b/pom.xml
index ad145ff..e9967f3 100644
--- a/pom.xml
+++ b/pom.xml
@@ -78,6 +78,9 @@
     <maven.version>3.9.16</maven.version>
     <!-- The version the plugin is compiled and tested against. Builds that use the plugin name their own. -->
     <open-java-format.version>2.98.0.3</open-java-format.version>
+    <!-- What JReleaser does: deploy to Maven Central, unless the github-release profile below is active. -->
+    <jreleaser.central.deploy>ALWAYS</jreleaser.central.deploy>
+    <jreleaser.github.release>false</jreleaser.github.release>
   </properties>
 
   <dependencies>
@@ -224,8 +227,9 @@
       </plugin>
       <!--
         Signs what `mvn deploy -DaltDeploymentRepository=local::file:target/staging-deploy` staged and
-        publishes it to Maven Central. .github/workflows/release.yml runs it on a tag; with
-        -Djreleaser.dry.run=true it rehearses without uploading.
+        publishes it to Maven Central, and with the github-release profile opens the draft GitHub
+        release. .github/workflows/release.yml runs both on a tag; with -Djreleaser.dry.run=true they
+        rehearse without uploading.
       -->
       <plugin>
         <groupId>org.jreleaser</groupId>
@@ -236,12 +240,31 @@
             <project>
               <license>MIT</license>
             </project>
-            <!-- Maven Central only: no GitHub release. -->
+            <!--
+              A draft GitHub release on the tag, with the plugin jar, its signature, a checksum file and
+              the commits since the previous tag. The tag is pushed by hand and is the version, so the
+              release only attaches to it; it is published by hand after a look.
+            -->
             <release>
               <github>
-                <enabled>false</enabled>
+                <enabled>${jreleaser.github.release}</enabled>
+                <skipTag>true</skipTag>
+                <tagName>{{projectVersion}}</tagName>
+                <releaseName>{{projectVersion}}</releaseName>
+                <draft>true</draft>
+                <changelog>
+                  <formatted>ALWAYS</formatted>
+                  <format>- {{commitShortHash}} {{commitTitle}}</format>
+                </changelog>
               </github>
             </release>
+            <files>
+              <artifacts>
+                <artifact>
+                  <path>${project.build.directory}/${project.build.finalName}.jar</path>
+                </artifact>
+              </artifacts>
+            </files>
             <!--
               The key comes from JRELEASER_GPG_SECRET_KEY and JRELEASER_GPG_PASSPHRASE. There is no
               public key to check the signatures against, hence verify = false.
@@ -263,7 +286,7 @@
                     Maven Central to serve the files.
                   -->
                   <sonatype>
-                    <active>ALWAYS</active>
+                    <active>${jreleaser.central.deploy}</active>
                     <url>https://central.sonatype.com/api/v1/publisher</url>
                     <namespace>dev.openjavaformat</namespace>
                     <applyMavenCentralRules>true</applyMavenCentralRules>
@@ -298,4 +321,18 @@
       </plugins>
     </pluginManagement>
   </build>
+
+  <profiles>
+    <!--
+      The draft GitHub release, for the job in release.yml that runs once the plugin is on Maven
+      Central: `mvn -P github-release jreleaser:release` releases the jar in target/ and deploys nothing.
+    -->
+    <profile>
+      <id>github-release</id>
+      <properties>
+        <jreleaser.central.deploy>NEVER</jreleaser.central.deploy>
+        <jreleaser.github.release>true</jreleaser.github.release>
+      </properties>
+    </profile>
+  </profiles>
 </project>