diff --git a/.github/workflows/store-delivery.yml b/.github/workflows/store-delivery.yml
index 7c12e54e..1ba8b1c9 100644
--- a/.github/workflows/store-delivery.yml
+++ b/.github/workflows/store-delivery.yml
@@ -309,8 +309,10 @@ jobs:
           test -n "$ASC_API_KEY_BASE64"
           python3 -m pip install --quiet PyJWT cryptography
           log_file="$RUNNER_TEMP/xcode-cloud-control.log"
+          # Manual Xcode Cloud workflows reject tags that are not in the start
+          # condition. Start the Archive workflow on its configured default
+          # (main) and require the immutable Release commit.
           python3 .edgeever-ci/scripts/xcode-cloud-control.py start \
-            --git-ref "refs/tags/${RELEASE_TAG}" \
             --require-sha "$(git rev-parse HEAD)" \
             --wait \
             --wait-valid |
diff --git a/docs/ios-xcode-cloud.md b/docs/ios-xcode-cloud.md
index 95206cd0..378418e7 100644
--- a/docs/ios-xcode-cloud.md
+++ b/docs/ios-xcode-cloud.md
@@ -91,8 +91,11 @@ Rules:
 ## Routine: ship a store binary
 
 Formal Releases do this automatically when `apps/ios` or the shared editor
-runtime changed: `bun run release` bumps `MARKETING_VERSION`, starts Xcode Cloud
-for the Release tag, waits until the build is **Valid**, and submits App Review.
+runtime changed: `bun run release` bumps `MARKETING_VERSION`, starts the Manual
+Xcode Cloud Archive workflow, requires the source commit to match the Release
+tag, waits until the build is **Valid**, and submits App Review. The Cloud
+workflow stays Manual, so Apple rejects starting it on a tag that is not in
+the start condition.
 
 To retry or ship iOS without a new GitHub Release:
 
diff --git a/docs/store-delivery.md b/docs/store-delivery.md
index 6cf35e7f..1673a66e 100644
--- a/docs/store-delivery.md
+++ b/docs/store-delivery.md
@@ -84,7 +84,7 @@ both runtimes changed:
 bun run publish:stores -- --release v1.7.0
 ```
 
-Deliver only iOS, starting Xcode Cloud for the Release tag:
+Deliver only iOS, starting the Manual Xcode Cloud Archive workflow:
 
 ```sh
 bun run publish:stores -- --release v1.7.0 --platform ios
@@ -140,7 +140,8 @@ Native iOS store binaries come from **`apps/ios`** (SwiftUI), not Expo EAS.
 On macOS beta hosts, archives must go through **Xcode Cloud** so
 `BuildMachineOSBuild` is a release OS image — see
 [iOS Xcode Cloud](ios-xcode-cloud.md). The store-delivery workflow starts that
-Archive workflow for the Release tag, waits until App Store Connect marks the
+Manual Archive workflow on its configured default branch, requires the source
+commit to match the Release tag, waits until App Store Connect marks the
 build Valid, then Fastlane (`apps/ios` `submit_review`) submits App Review and
 configures automatic release after approval. Pass `--ios-build-number` only to
 reuse an already uploaded build. Missing metadata, agreements, review
diff --git a/docs/store-delivery.zh-CN.md b/docs/store-delivery.zh-CN.md
index cbcd1c68..39585674 100644
--- a/docs/store-delivery.zh-CN.md
+++ b/docs/store-delivery.zh-CN.md
@@ -73,7 +73,7 @@ EAS Submit 要求应用已经在对应商店中创建；Google Play API 提交
 bun run publish:stores -- --release v1.7.0
 ```
 
-只交付 iOS，并为该 Release tag 启动 Xcode Cloud：
+只交付 iOS，并启动手动触发的 Xcode Cloud Archive：
 
 ```sh
 bun run publish:stores -- --release v1.7.0 --platform ios
@@ -124,10 +124,11 @@ Release。默认命令直接使用 Production；只有明确要求测试交付
 原生 iOS 商店二进制来自 **`apps/ios`**（SwiftUI），不再走 Expo EAS。
 在 macOS beta 本机上，Archive 必须通过 **Xcode Cloud**，保证
 `BuildMachineOSBuild` 来自正式系统镜像——见
-[iOS Xcode Cloud](ios-xcode-cloud.md)。商店交付工作流会针对 Release tag 启动
-该 Archive，等到 App Store Connect 将构建标为 Valid，再用 Fastlane（`apps/ios`
-的 `submit_review`）提交 App Review，并设置为审核通过后自动发布。只有复用已经
-上传的构建时才传入 `--ios-build-number`。元数据、协议、审核信息或凭据不完整时
+[iOS Xcode Cloud](ios-xcode-cloud.md)。商店交付工作流会按 Archive 工作流配置的
+默认分支启动这次手动构建，并要求源提交与 Release tag 一致，等到 App Store
+Connect 将构建标为 Valid，再用 Fastlane（`apps/ios` 的 `submit_review`）提交
+App Review，并设置为审核通过后自动发布。只有复用已经上传的构建时才传入
+`--ios-build-number`。元数据、协议、审核信息或凭据不完整时
 工作流会失败，不会改为提交其他构建。
 
 商店列表本地化（含日文）存放在 `apps/mobile/store-assets/`，需在 App Store
diff --git a/scripts/store-delivery.test.mjs b/scripts/store-delivery.test.mjs
index 48fbe36c..4cb49c60 100644
--- a/scripts/store-delivery.test.mjs
+++ b/scripts/store-delivery.test.mjs
@@ -76,6 +76,8 @@ describe("store delivery command", () => {
     );
     expect(workflow).toContain(".edgeever-ci/scripts/xcode-cloud-control.py");
     expect(workflow).toContain("--wait-valid");
+    expect(workflow).toContain("--require-sha");
+    expect(workflow).not.toContain("--git-ref");
     expect(workflow).toContain("grep -E '^(build_number|app_store_build_id|build_run_id|source_sha|processing_state)='");
     expect(workflow).toContain('refs/tags/${RELEASE_TAG}');
     expect(workflow).toContain(