diff --git a/.github/workflows/production-e2e.yml b/.github/workflows/production-e2e.yml
index 59fc401..ece1cdb 100644
--- a/.github/workflows/production-e2e.yml
+++ b/.github/workflows/production-e2e.yml
@@ -48,7 +48,7 @@ permissions:
 jobs:
   production-e2e:
     name: Production Live Delivery (k3s)
-    if: github.event_name == 'workflow_call' || inputs.confirmation == 'production'
+    if: (github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, '0.')) || (github.event_name == 'workflow_dispatch' && inputs.confirmation == 'production')
     runs-on: ubuntu-latest
     timeout-minutes: 22
     environment: production
diff --git a/.test/release-workflow.sh b/.test/release-workflow.sh
index eb1f78b..cbf18bd 100755
--- a/.test/release-workflow.sh
+++ b/.test/release-workflow.sh
@@ -3,6 +3,7 @@
 set -Eeuo pipefail
 
 readonly WORKFLOW=".github/workflows/release.yml"
+readonly PRODUCTION_WORKFLOW=".github/workflows/production-e2e.yml"
 
 job_block() {
   local job="$1"
@@ -29,6 +30,9 @@ assert_needs chart-publication '[image, image-validation, version-promotion]'
 assert_needs promote '[image, chart-publication]'
 assert_needs release '[image, promote]'
 
+grep -Fqx "    if: (github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, '0.')) || (github.event_name == 'workflow_dispatch' && inputs.confirmation == 'production')" \
+  "${PRODUCTION_WORKFLOW}"
+
 [[ "$(grep -c '^  release:$' "${WORKFLOW}")" == "1" ]]
 job_block release | grep -Fq 'gh release create'
 job_block promote | grep -Fq 'image-release.sh promote-latest'