diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 68f5b62c..7602481a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -272,14 +272,26 @@ jobs:
     needs: winget-manifests
     runs-on: ubuntu-latest
     steps:
-      - name: Check for a winget token
+      - name: Check for a winget token and a published package
         id: gate
         env:
           WINGET_TOKEN: ${{ secrets.WINGET_TOKEN }}
+          # Flip to "true" ONLY after Coderise.OKF4net.Render's first manifest
+          # has actually been merged into microsoft/winget-pkgs. winget-releaser
+          # UPDATES an existing package -- it cannot create one -- so running it
+          # before that first manual submission fails the release, and the
+          # artifacts it would need to submit are produced by that very release.
+          # That chicken-and-egg is why this second gate exists on top of the
+          # token check; Coderise.OKF4net needs no equivalent because it is
+          # already published.
+          RENDER_PUBLISHED: ${{ vars.WINGET_RENDER_PUBLISHED }}
         run: |
           if [ -z "$WINGET_TOKEN" ]; then
             echo "::notice::No WINGET_TOKEN secret; skipping the winget-pkgs PR. The manifests are attached to the Release -- submit them with \`wingetcreate submit\`."
             echo "go=false" >> "$GITHUB_OUTPUT"
+          elif [ "$RENDER_PUBLISHED" != "true" ]; then
+            echo "::notice::Coderise.OKF4net.Render is not published to winget-pkgs yet, so there is nothing to update. Submit this release's manifests manually (they are attached to the Release), then set the repository variable WINGET_RENDER_PUBLISHED=true so future releases submit automatically."
+            echo "go=false" >> "$GITHUB_OUTPUT"
           else
             echo "go=true" >> "$GITHUB_OUTPUT"
           fi
diff --git a/packaging/winget/README.md b/packaging/winget/README.md
index 44c6e9e5..dd2774d1 100644
--- a/packaging/winget/README.md
+++ b/packaging/winget/README.md
@@ -82,11 +82,29 @@ Prerequisites: `winget install Microsoft.WingetCreate`, and a fork of
 [`winget-releaser`](https://github.com/vedantmgoyal9/winget-releaser) (the
 tool behind the `winget-submit*` jobs) **updates an existing package — it
 does not create one.** `Coderise.OKF4net.Render` has no published version in
-winget-pkgs yet, so `winget-submit-render` will keep failing (or skipping, if
-`WINGET_TOKEN` is also unset) until someone runs the manual
-`wingetcreate submit` flow above for it at least once. Do not expect a tag
-push to publish the render package by itself — that first PR has to be
-opened by hand.
+winget-pkgs yet, so its first PR has to be opened by hand via the
+`wingetcreate submit` flow above. Do not expect a tag push to publish the
+render package by itself.
+
+Because of that, `winget-submit-render` is gated on **two** things, not just
+the `WINGET_TOKEN` secret: it also requires the repository variable
+`WINGET_RENDER_PUBLISHED` to be `true`. Without it the job skips with a
+notice instead of failing the release — which matters, because the artifacts
+the first manual submission needs are produced by the very release that would
+otherwise run this job against a package that does not exist.
+
+The sequence is therefore:
+
+1. Tag and release. The render manifests are generated and attached to the
+   Release; `winget-submit-render` skips with a notice.
+2. Submit those manifests manually (see above) and get the winget-pkgs PR
+   merged.
+3. Set the repository variable `WINGET_RENDER_PUBLISHED=true`
+   (Settings → Secrets and variables → Actions → Variables).
+
+From the next release on, the render package updates automatically like
+`Coderise.OKF4net` does. That one needs no such gate — it is already
+published.
 
 ## Regenerating manifests locally