diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 42dd8e8..c2ee240 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,8 +30,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      # Mints the short-lived OIDC credential used for trusted publishing.
-      # No npm token is stored anywhere — this is the credential.
       id-token: write
     steps:
       - uses: actions/checkout@v6
@@ -46,18 +44,22 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           cache: pnpm
 
-      # Trusted publishing (OIDC) requires npm >= 11.5.1.
       - name: Ensure npm supports trusted publishing
         run: npm install -g npm@latest
 
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
 
-      # No NODE_AUTH_TOKEN: npm authenticates via OIDC using the trusted
-      # publisher configured on npmjs.com. Provenance is generated
-      # automatically, so --provenance is not needed.
       - name: Publish
-        run: npm publish --access public
+        run: |
+          VERSION="$(node -p "require('./package.json').version")"
+          if [[ "$VERSION" == *-* ]]; then
+            TAG="${VERSION#*-}"; TAG="${TAG%%.*}"
+          else
+            TAG="latest"
+          fi
+          echo "Publishing $VERSION to dist-tag '$TAG'"
+          npm publish --access public --tag "$TAG"
 
   publish-gh-packages:
     name: Publish to GitHub Packages
@@ -82,13 +84,18 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
 
-      # GitHub Packages requires a scoped name matching the repository owner.
-      # The scoped name applies only to this registry; npm keeps the
-      # unscoped "web-component-base".
       - name: Scope package name for GitHub Packages
         run: npm pkg set name="@ayo-run/web-component-base"
 
       - name: Publish
-        run: npm publish
+        run: |
+          VERSION="$(node -p "require('./package.json').version")"
+          if [[ "$VERSION" == *-* ]]; then
+            TAG="${VERSION#*-}"; TAG="${TAG%%.*}"
+          else
+            TAG="latest"
+          fi
+          echo "Publishing $VERSION to dist-tag '$TAG'"
+          npm publish --tag "$TAG"
         env:
           NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}