diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2d10012f87a..b1f9b632387 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -883,7 +883,7 @@ jobs:
 
   finalize:
     name: Finalize release
-    if: false # Disabled for the fork: avoid committing release-only version bumps back to main.
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.release.result == 'success' }}
     needs: [preflight, release]
     runs-on: ubuntu-latest
     timeout-minutes: 10
diff --git a/FORK.md b/FORK.md
index e65c80ecf16..a0ed46ba80e 100644
--- a/FORK.md
+++ b/FORK.md
@@ -9,7 +9,7 @@ This repository is a fork of `pingdotgg/t3code`. Keep this file focused on fork
 - Fork workflows disable scheduled releases, relay jobs, hosted deploys, and fork-unsafe publish paths.
 - Release build jobs skip relay client tracing config because the relay config job is disabled.
 - Release builds publish updater metadata against the fork repository.
-- Fork release versions are derived in the release workflow so package manifests stay close to upstream.
+- Fork release versions are derived in the release workflow and committed back to main after release.
 - macOS release signing is separate from Apple notarization.
 - Self-signed macOS signing certificates are trusted during release builds.