diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index a2d93536..7921a333 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -44,4 +44,5 @@ jobs:
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
-        run: npm publish --provenance --access public
+        # Without --tag alpha npm moves the latest tag to the prerelease
+        run: npm publish --tag alpha --provenance --access public
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 9ec05a51..38fd9e69 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -26,4 +26,4 @@ jobs:
               # Set if: always() to also generate the report if tests are failing
               # Only works if you set `reportOnFailure: true` in your vite config as specified above
               if: always()
-              uses: davelosert/vitest-coverage-report-action@v2
+              uses: davelosert/vitest-coverage-report-action@c4bbc33a89b7ace0e63d35f1f7d4bcee31155a73 # v2.13.0
diff --git a/package.json b/package.json
index 350bee73..a4ea26f6 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
         "test:coverage": "vitest --coverage",
         "dev": "NODE_OPTIONS='--max-old-space-size=16384' tsup --watch --config tsup.config.dev.js",
         "prepare": "husky",
+        "prepack": "npm run build",
         "lint": "eslint src",
         "lint:fix": "eslint --fix",
         "prettier": "prettier src --check",