diff --git a/.github/release-notes/v1.1.0.md b/.github/release-notes/v1.1.0.md
new file mode 100644
index 0000000..ecef5b0
--- /dev/null
+++ b/.github/release-notes/v1.1.0.md
@@ -0,0 +1,10 @@
+## DupFinder 1.1.0: open source under the GPLv3, built on GitHub
+
+Finding duplicates works exactly as in 1.0.1. What changes is the license and where the exe comes from.
+
+- **New license: GPL-3.0-only.** DupFinder is now free software like the other burnersen tools: free for everyone, at home or at work. Whoever passes it on must include the complete source code under the same license. Versions up to 1.0.1 stay under the PolyForm Noncommercial License they were released with.
+- **Built by GitHub Actions:** from this version on, `DupFinder.exe` is built and published by GitHub Actions from the source in this repository, no longer on the developer's PC. A dry run checks the whole build without publishing anything.
+- **File properties:** the exe shows its name and version under right-click > Properties > Details.
+- **Code signing prepared:** free code signing through the SignPath Foundation is applied for. Until it is active the exe stays unsigned. What would be signed and what DupFinder sends over the network (only the FFmpeg download): [code signing policy](https://github.com/burnersen/DupFinder/blob/main/CODE_SIGNING.md).
+
+Update: replace `DupFinder.exe` with the new one. Your decisions and the downloaded FFmpeg next to it stay.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 37dddd3..2224784 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,7 +30,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Existing tag to release (for example v2.2.0)'
+        description: 'Version to release, e.g. v2.2.0: an existing tag is built as it is, a new one is built from main and tagged'
         required: true
       dry_run:
         description: 'Dry run: build and check only, sign and publish nothing'
@@ -60,7 +60,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.tag || github.ref }}
           # The annotated tag message can be the release text, and it only
           # exists in a clone that carries the tag objects.
           fetch-depth: 0
@@ -74,6 +73,26 @@ jobs:
           go-version: 'stable'
           cache: false
 
+      # Started by hand: an existing tag is built exactly as tagged. A new
+      # version is built from main, and publishing the release creates its
+      # tag on the commit that was built.
+      - name: Commit to build
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          git rev-parse -q --verify "refs/tags/$env:RELEASE_TAG" *> $null
+          if ($LASTEXITCODE -eq 0) {
+            git checkout -q --detach "refs/tags/$env:RELEASE_TAG"
+            Write-Host "Building the existing tag $env:RELEASE_TAG."
+          } elseif ($env:GITHUB_REF_NAME -ne 'main' -and $env:DRY_RUN -ne 'true') {
+            Write-Host "::error::A new version is released from main only, not from $env:GITHUB_REF_NAME."
+            exit 1
+          } else {
+            Write-Host "Tag $env:RELEASE_TAG does not exist yet: building $env:GITHUB_REF_NAME, the release creates the tag."
+          }
+          $global:LASTEXITCODE = 0
+
       # A tag that disagrees with appVersion would publish an exe that names
       # another version. A pull request has no tag: it builds the version in
       # main.go.
@@ -215,5 +234,5 @@ jobs:
             gh release edit $tag --title $title --notes-file release-notes.md --draft=false
             gh release upload $tag DupFinder.exe --clobber
           } else {
-            gh release create $tag DupFinder.exe --title $title --notes-file release-notes.md
+            gh release create $tag DupFinder.exe --target (git rev-parse HEAD) --title $title --notes-file release-notes.md
           }
diff --git a/main.go b/main.go
index 751a382..e09fa8b 100644
--- a/main.go
+++ b/main.go
@@ -27,7 +27,7 @@ var webAssets embed.FS
 
 // appVersion ist die zentrale Versionsnummer (semantisch). Bei jedem Release nur
 // hier erhöhen.
-const appVersion = "1.0.1"
+const appVersion = "1.1.0"
 
 var shutdownRequested atomic.Bool