diff --git a/.github/workflows/dapr_cli.yaml b/.github/workflows/dapr_cli.yaml
index 6861794d0..b53f34bf2 100644
--- a/.github/workflows/dapr_cli.yaml
+++ b/.github/workflows/dapr_cli.yaml
@@ -200,3 +200,19 @@ jobs:
             $PackageIdentifier="Dapr.CLI"
           }
           .\wingetcreate.exe update "$PackageIdentifier" --submit --urls "$url|x64" --version "${{ env.REL_VERSION }}" --token "${{ secrets.DAPR_BOT_TOKEN }}"
+
+  # Opens (or comments on) a tracking issue when a tagged release fails
+  # anywhere in the build/publish chain.
+  notify-on-failure:
+    needs: [build, publish, publish-winget]
+    if: failure() && (startsWith(github.ref, 'refs/tags/v') || inputs.tag != '')
+    permissions:
+      issues: write
+      actions: read
+    uses: dapr/.github/.github/workflows/open-issue-on-failure.yml@main
+    with:
+      title: "Release publish failed: ${{ github.workflow }} (${{ inputs.tag || github.ref_name }})"
+      labels: "release,ci/publish-failure"
+      mention: "@dapr/maintainers-cli @dapr/approvers-cli"
+    secrets:
+      dapr_bot_token: ${{ secrets.DAPR_BOT_TOKEN }}