diff --git a/Taskfile.yaml b/Taskfile.yaml
index b83dff152c67fc6dd22118836de2b845c150a327..8cc6b5555cdeb7c651cd39084a4cb75aca3676ef 100644
--- a/Taskfile.yaml
+++ b/Taskfile.yaml
@@ -143,9 +143,32 @@ tasks:
     cmds:
       - git tag -d nightly || true
       - git fetch upstream --tags
-      - crush run "Please update the mentioned version in the top of the README to {{.TAG}}. You only need to read the first 65 lines for the relevant bits. Commit when you're done."
+      - >-
+        crush run "Please update the mentioned version in the top of the README to {{.TAG}}.
+        You only need to read the first 65 lines for the relevant bits.
+        Commit with 'docs(README): bump to [ver]' when you're done."
+      - git show --stat HEAD
+      - defer:
+          task: release:fork:cleanup
+          vars:
+            TAG: "{{.TAG}}"
+      - task: release:fork:confirm
       - git tag -a {{.TAG}}
       - git push soft {{.TAG}}
       - echo "Released {{.TAG}}"
       - go list -m git.secluded.site/crush@{{.TAG}} > /dev/null
       - echo "Module proxy notified"
+
+  release:fork:confirm:
+    desc: Review LLM-generated commit and confirm release
+    internal: true
+    prompt: "Proceed with release?"
+
+  release:fork:cleanup:
+    desc: Undo LLM commit if release aborted
+    internal: true
+    cmds:
+      - git reset --hard HEAD~1
+      - git tag -d {{.TAG}} 2>/dev/null || true
+    status:
+      - git tag -l {{.TAG}} | grep -q {{.TAG}}