diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bdef7427f..ce610267c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,12 +1,15 @@
 name: release
 on:
-  release:
-    types: ["released"]
+  push:
+    tags:
+      # this will trigger on "v2.0.0" but not on "v2.0.0-beta.0" or "v2.0.0-alpha.1"
+      - "v[0-9]+.[0-9]+.[0-9]+"
 jobs:
   krewrelease:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@master
-      - name: Update new version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.40
+      - name: Update with new version in krew-index
+        # v0.0.40, referenced by hash
+        uses: rajatjindal/krew-release-bot@56925b62bacc2c652114d66a8256faaf0bf89fa9
diff --git a/.krew.yaml b/.krew.yaml
index 153feaabe..de130d5a1 100644
--- a/.krew.yaml
+++ b/.krew.yaml
@@ -18,6 +18,12 @@ spec:
         arch: amd64
     {{addURIAndSha "https://github.com/jetstack/cert-manager/releases/download/{{ .TagName }}/kubectl-cert_manager-darwin-amd64.tar.gz" .TagName }}
     bin: kubectl-cert_manager
+  - selector:
+      matchLabels:
+        os: darwin
+        arch: arm64
+    {{addURIAndSha "https://github.com/jetstack/cert-manager/releases/download/{{ .TagName }}/kubectl-cert_manager-darwin-arm64.tar.gz" .TagName }}
+    bin: kubectl-cert_manager
   - selector:
       matchLabels:
         os: linux