diff --git a/.github/workflows/release-cosmos-plugin-reusable.yml b/.github/workflows/release-cosmos-plugin-reusable.yml
index 29d508d..58505ea 100644
--- a/.github/workflows/release-cosmos-plugin-reusable.yml
+++ b/.github/workflows/release-cosmos-plugin-reusable.yml
@@ -47,6 +47,19 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Validate OPENC3_API_TOKEN
+        if: ${{ inputs.deploy_to_store }}
+        env:
+          OPENC3_API_TOKEN: ${{ secrets.OPENC3_API_TOKEN }}
+        run: |
+          if [ -z "$OPENC3_API_TOKEN" ]; then
+            echo "Error: deploy_to_store is true but the OPENC3_API_TOKEN secret is empty"
+            echo "Add the key to the repo secrets and pass it through, e.g."
+            echo "  secrets:"
+            echo '    OPENC3_API_TOKEN: $''{{ secrets.OPENC3_API_TOKEN }}'
+            exit 1
+          fi
+
       - name: Validate semver format
         run: |
           if ! echo "${{ inputs.version }}" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$'; then
@@ -198,8 +211,17 @@ jobs:
           else
             TAG_NAME="${{ steps.plugin_info.outputs.plugin_name }}/v${{ inputs.version }}"
           fi
-          git tag -a "$TAG_NAME" -m "Release ${{ steps.plugin_info.outputs.plugin_name }} version ${{ inputs.version }}"
-          git push origin "$TAG_NAME"
+
+          git fetch --tags
+
+          if git rev-parse "$TAG_NAME" >/dev/null 2>&1; then
+            echo "Tag $TAG_NAME already exists, skipping tag creation"
+          else
+            git tag -a "$TAG_NAME" -m "Release ${{ steps.plugin_info.outputs.plugin_name }} version ${{ inputs.version }}"
+            git push origin "$TAG_NAME"
+            echo "Created and pushed tag $TAG_NAME"
+          fi
+
           echo "tag_name=$TAG_NAME" >> "$GITHUB_OUTPUT"
         id: tag_info