diff --git a/Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj b/Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj
index 944968b..117f0c4 100644
--- a/Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj
+++ b/Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj
@@ -5,9 +5,9 @@
     <RootNamespace>Jellyfin.Plugin.OidcAuth</RootNamespace>
     <!-- Kept in sync with build.yaml by scripts/build_plugin.py; the release
          workflow overrides these with the version from the git tag. -->
-    <Version>1.0.3.0</Version>
-    <AssemblyVersion>1.0.3.0</AssemblyVersion>
-    <FileVersion>1.0.3.0</FileVersion>
+    <Version>1.0.4.0</Version>
+    <AssemblyVersion>1.0.4.0</AssemblyVersion>
+    <FileVersion>1.0.4.0</FileVersion>
     <Nullable>enable</Nullable>
     <ImplicitUsings>disable</ImplicitUsings>
     <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
diff --git a/build.yaml b/build.yaml
index 68df90a..2a645fd 100644
--- a/build.yaml
+++ b/build.yaml
@@ -1,7 +1,7 @@
 ---
 name: "OIDC Auth"
 guid: "96badb44-9940-4ff0-befc-5f987159152c"
-version: "1.0.3.0"
+version: "1.0.4.0"
 targetAbi: "10.11.0.0"
 framework: "net9.0"
 owner: "pascallinxweiler"
diff --git a/dist/oidc-auth_1.0.4.0.zip b/dist/oidc-auth_1.0.4.0.zip
new file mode 100644
index 0000000..5d4dd60
Binary files /dev/null and b/dist/oidc-auth_1.0.4.0.zip differ
diff --git a/manifest.json b/manifest.json
index 3814300..7667c76 100644
--- a/manifest.json
+++ b/manifest.json
@@ -7,6 +7,14 @@
         "owner": "pascallinxweiler",
         "category": "Authentication",
         "versions": [
+            {
+                "version": "1.0.4.0",
+                "changelog": "fix: make the release workflow build and package a real Jellyfin plugin\n\nThe release workflow was copied from another project and could not succeed on\nany tag: it installed the .NET 8 SDK for a net9.0 project, published a\nJellyfinSso.csproj that does not exist, called a missing update_manifest.py,\nand zipped the entire publish tree instead of the three DLLs declared in\nbuild.yaml.\n\nReplace it with a tag-driven release:\n\n- Build with the .NET 9 SDK, injecting the tag version via -p:Version,\n  -p:AssemblyVersion and -p:FileVersion so the assembly no longer carries a\n  hardcoded 1.0.3.0.\n- Package via scripts/build_plugin.py, which emits the JPRM layout Jellyfin\n  expects: the build.yaml artifacts plus a generated meta.json. The previous\n  zips shipped without meta.json, which only worked for repository installs\n  because Jellyfin synthesises one from the folder name.\n- Update manifest.json via scripts/update_manifest.py, keeping build.yaml as\n  the single source of truth for plugin metadata.\n- Commit the zip and manifest to main and attach the zip to the Gitea release.\n  Pushing uses the injected token, falling back to a RELEASE_TOKEN secret when\n  the built-in one lacks write access.\n\nAlso fix the published download URLs. manifest.json and the README pointed at\npascallinxweiler/jellyfinplugin, which 404s; the repository is jellyfinsso, so\nthe plugin repository could not be added to Jellyfin and no version could be\ndownloaded. The workflow now derives the URL from GITHUB_REPOSITORY.\n\nAdd a build workflow so main and pull requests are compiled and packaged.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
+                "targetAbi": "10.11.0.0",
+                "sourceUrl": "https://git.linxweiler.xyz/pascallinxweiler/jellyfinsso/raw/branch/main/dist/oidc-auth_1.0.4.0.zip",
+                "checksum": "afcf05fb5d8737273fdc9ca2195853d6",
+                "timestamp": "2026-07-29T13:26:22Z"
+            },
             {
                 "version": "1.0.3.0",
                 "changelog": "Admin role mapping now only grants admin by default. New opt-in setting 'Also revoke admin when the admin role is missing' restores the old revoking behavior.",