diff --git a/.github/workflows/publish-js.yml b/.github/workflows/publish-js.yml
index 29f3c05f..a5f2e097 100644
--- a/.github/workflows/publish-js.yml
+++ b/.github/workflows/publish-js.yml
@@ -395,14 +395,31 @@ jobs:
         run: ls -lh bashkit.*.node bashkit.*.wasm 2>/dev/null || true
         working-directory: crates/bashkit-js
 
-      - name: Publish
+      - name: Determine npm dist-tag
+        id: dist-tag
+        working-directory: crates/bashkit-js
         run: |
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          echo "version=$PKG_VERSION"
+
+          # Stable if triggered by a release tag, OR if workflow_dispatch
+          # and the version looks like a stable semver (no pre-release suffix).
           if [[ "$GITHUB_REF" =~ ^refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Publishing stable release"
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          elif [[ "$PKG_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=next" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish
+        run: |
+          TAG="${{ steps.dist-tag.outputs.tag }}"
+          echo "Publishing with dist-tag: $TAG"
+          if [ "$TAG" = "latest" ]; then
             npm publish --provenance --access public
           else
-            echo "Publishing pre-release with 'next' tag"
-            npm publish --provenance --tag next --access public
+            npm publish --provenance --tag "$TAG" --access public
           fi
         working-directory: crates/bashkit-js
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d06da5d9..7622ad2b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -72,13 +72,19 @@ jobs:
           draft: false
           prerelease: false
 
+      # Note: the `release: [published]` event does NOT trigger other
+      # workflows when the release is created with GITHUB_TOKEN (GitHub
+      # prevents recursive workflow triggers). We must dispatch explicitly.
+      # Use --ref to set GITHUB_REF to the tag so publish-js correctly
+      # identifies stable releases.
       - name: Trigger publish workflows
-        run: |
-          gh workflow run publish.yml
-          gh workflow run publish-python.yml
-          gh workflow run publish-js.yml
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="${{ steps.version.outputs.tag }}"
+          gh workflow run publish.yml --ref "$TAG"
+          gh workflow run publish-python.yml --ref "$TAG"
+          gh workflow run publish-js.yml --ref "$TAG"
 
       - name: Trigger CLI binary builds for release tag
         env: