diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index db49a8f5a32a0..557779a114a39 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -24,6 +24,10 @@ on:
         description: Perform a dry-run release.
         type: boolean
         required: true
+      ignore_missing_commit_metadata:
+        description: WARNING! This option disables the requirement that all commits have a PR. Not needed for dry_run.
+        type: boolean
+        default: false
 
 permissions:
   # Required to publish a release
@@ -36,6 +40,7 @@ permissions:
 env:
   CODER_RELEASE: ${{ github.event.inputs.snapshot && 'false' || 'true' }}
   DRY_RUN: ${{ (github.event.inputs.dry_run || github.event.inputs.snapshot) && 'true' || 'false' }}
+  CODER_IGNORE_MISSING_COMMIT_METADATA: ${{ github.event.inputs.ignore_missing_commit_metadata && '1' || '0' }}
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
@@ -65,6 +70,45 @@ jobs:
           git config user.name "GitHub Actions Bot"
           git config user.email ""
 
+      - name: Create release tag and release notes
+        run: |
+          set -euo pipefail
+          ref=HEAD
+          old_version="$(git describe --abbrev=0 "$ref^1")"
+
+          # Warn if CODER_IGNORE_MISSING_COMMIT_METADATA is set any other way
+          # than via dry-run.
+          if [[ ${CODER_IGNORE_MISSING_COMMIT_METADATA:-0} != 0 ]]; then
+            echo "WARNING: CODER_IGNORE_MISSING_COMMIT_METADATA is enabled and we will ignore missing commit metadata." 1>&2
+          fi
+
+          if [[ $DRY_RUN == true ]]; then
+            # Allow dry-run of branches to pass.
+            export CODER_IGNORE_MISSING_COMMIT_METADATA=1
+          fi
+
+          # Cache commit metadata.
+          . ./scripts/release/check_commit_metadata.sh "$old_version" "$ref"
+
+          # Create new release tag (note that this tag is not pushed before
+          # release.sh is run).
+          version="$(
+            ./scripts/release/tag_version.sh \
+              ${{ (github.event.inputs.dry_run || github.event.inputs.snapshot) && '--dry-run' }} \
+              --ref "$ref" \
+              --${{ github.event.inputs.increment }}
+          )"
+
+          # Generate notes.
+          release_notes_file="$(mktemp -t release_notes.XXXXXX)"
+          ./scripts/release/generate_release_notes.sh --old-version "$old_version" --new-version "$version" --ref "$ref" >> "$release_notes_file"
+          echo CODER_RELEASE_NOTES_FILE="$release_notes_file" >> $GITHUB_ENV
+
+      - name: Echo release notes
+        run: |
+          set -euo pipefail
+          cat "$CODER_RELEASE_NOTES_FILE"
+
       - name: Docker Login
         uses: docker/login-action@v2
         with:
@@ -120,38 +164,6 @@ jobs:
           AC_CERTIFICATE_PASSWORD: ${{ secrets.AC_CERTIFICATE_PASSWORD }}
           AC_APIKEY_P8_BASE64: ${{ secrets.AC_APIKEY_P8_BASE64 }}
 
-      - name: Create release tag and release notes
-        run: |
-          set -euo pipefail
-          ref=HEAD
-          old_version="$(git describe --abbrev=0 "$ref^1")"
-
-          if [[ $DRY_RUN == true ]]; then
-            # Allow dry-run of branches to pass.
-            export CODER_IGNORE_MISSING_COMMIT_METADATA=1
-          fi
-
-          # Cache commit metadata.
-          . ./scripts/release/check_commit_metadata.sh "$old_version" "$ref"
-
-          # Create new release tag.
-          version="$(
-            ./scripts/release/tag_version.sh \
-              ${{ (github.event.inputs.dry_run || github.event.inputs.snapshot) && '--dry-run' }} \
-              --ref "$ref" \
-              --${{ github.event.inputs.increment }}
-          )"
-
-          # Generate notes.
-          release_notes_file="$(mktemp -t release_notes.XXXXXX)"
-          ./scripts/release/generate_release_notes.sh --old-version "$old_version" --new-version "$version" --ref "$ref" >> "$release_notes_file"
-          echo CODER_RELEASE_NOTES_FILE="$release_notes_file" >> $GITHUB_ENV
-
-      - name: Echo release notes
-        run: |
-          set -euo pipefail
-          cat "$CODER_RELEASE_NOTES_FILE"
-
       - name: Build binaries
         run: |
           set -euo pipefail
diff --git a/scripts/release.sh b/scripts/release.sh
index bb2bb37d2685e..8dce7f91e3920 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -37,6 +37,12 @@ specified branch as the release commit. This will also set --dry-run.
 EOH
 }
 
+# Warn if CODER_IGNORE_MISSING_COMMIT_METADATA is set any other way than via
+# --branch.
+if [[ ${CODER_IGNORE_MISSING_COMMIT_METADATA:-0} != 0 ]]; then
+	log "WARNING: CODER_IGNORE_MISSING_COMMIT_METADATA is enabled externally, we will ignore missing commit metadata."
+fi
+
 branch=main
 draft=0
 dry_run=0
@@ -112,8 +118,10 @@ fi
 mapfile -t versions < <(gh api -H "Accept: application/vnd.github+json" /repos/coder/coder/git/refs/tags -q '.[].ref | split("/") | .[2]' | grep '^v' | sort -r -V)
 old_version=${versions[0]}
 
+trap 'log "Check commit metadata failed, you can try to set \"export CODER_IGNORE_MISSING_COMMIT_METADATA=1\" and try again, if you know what you are doing."' EXIT
 # shellcheck source=scripts/release/check_commit_metadata.sh
 source "$SCRIPT_DIR/release/check_commit_metadata.sh" "$old_version" "$ref"
+trap - EXIT
 
 new_version="$(execrelative ./release/tag_version.sh --dry-run --ref "$ref" --"$increment")"
 release_notes="$(execrelative ./release/generate_release_notes.sh --old-version "$old_version" --new-version "$new_version" --ref "$ref")"
@@ -141,9 +149,19 @@ fi
 args=()
 if ((draft)); then
 	args+=(-F draft=true)
+else
+	args+=(-F draft=false)
 fi
 if ((dry_run)); then
 	args+=(-F dry_run=true)
+else
+	args+=(-F dry_run=false)
+
+	# We only set this on non-dry-run releases because it will show a
+	# warning in CI.
+	if [[ ${CODER_IGNORE_MISSING_COMMIT_METADATA:-0} == 1 ]]; then
+		args+=(-F ignore_missing_commit_metadata=true)
+	fi
 fi
 
 log