diff --git a/.forgejo/workflows/publish-source.yml b/.forgejo/workflows/publish-source.yml
index 8220bac9..a08875ae 100644
--- a/.forgejo/workflows/publish-source.yml
+++ b/.forgejo/workflows/publish-source.yml
@@ -34,7 +34,16 @@ jobs:
 
           SOURCE_NPM_REG="https://source.soulcraft.com/api/packages/soulcraft/npm/"
           VERSION="$(node -p "require('./package.json').version")"
-          echo "Publishing @soulcraft/brainy@${VERSION} to The Source registry..."
+          # The dist-tag follows the version: a prerelease (any hyphen —
+          # 10.4.0-rc.1) publishes under 'rc' and must NEVER move 'latest' —
+          # every consumer resolving 'latest' from this registry would otherwise
+          # be handed a release candidate. Same rule scripts/release.sh applies
+          # to the storefront leg.
+          NPM_TAG="latest"
+          case "$VERSION" in
+            *-*) NPM_TAG="rc" ;;
+          esac
+          echo "Publishing @soulcraft/brainy@${VERSION} to The Source registry (dist-tag: ${NPM_TAG})..."
 
           TMPRC="$(mktemp)"
           chmod 600 "$TMPRC"
@@ -47,7 +56,7 @@ jobs:
           # this tag's checkout already carries the version being published —
           # nothing here re-derives it from the tag name.
           PUBLISH_OK=true
-          if ! npm publish --tag latest --userconfig "$TMPRC"; then
+          if ! npm publish --tag "$NPM_TAG" --userconfig "$TMPRC"; then
             PUBLISH_OK=false
           fi