diff --git a/.github/workflows/cd.brew.yml b/.github/workflows/cd.brew.yml
index bad4b2e9..e8ee0bcc 100644
--- a/.github/workflows/cd.brew.yml
+++ b/.github/workflows/cd.brew.yml
@@ -11,6 +11,7 @@ concurrency:
 
 jobs:
   bump-tap:
+    if: startsWith(github.event.release.tag_name, 2)
     runs-on: ubuntu-latest
     steps:
     - uses: aurelien-baudet/workflow-dispatch@v4
diff --git a/.github/workflows/cd.crates.yml b/.github/workflows/cd.crates.yml
index bedbea43..8053c455 100644
--- a/.github/workflows/cd.crates.yml
+++ b/.github/workflows/cd.crates.yml
@@ -15,6 +15,7 @@ concurrency:
 
 jobs:
   publish:
+    if: startsWith(github.event.release.tag_name, 2)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/cd.docker.yml b/.github/workflows/cd.docker.yml
index 69201f31..563c3b02 100644
--- a/.github/workflows/cd.docker.yml
+++ b/.github/workflows/cd.docker.yml
@@ -27,6 +27,22 @@ jobs:
           tag: ${{ github.event.inputs.tag }}
           fileName: pkgx-*.tar.xz
 
+      - name: determine if we are latest
+        id: tags
+        run: |
+          TAG_NAME="${{ github.event.release.tag_name || github.event.inputs.tag }}"
+          LATEST_RELEASE=$(gh api repos/${{ github.repository }}/releases/latest --jq '.tag_name')
+          if [ "$TAG_NAME" == "$LATEST_RELEASE" ]; then
+            TAGS="$TAGS type=raw,value=latest"
+          fi
+          echo "value=$TAGS" >> $GITHUB_OUTPUT
+        env:
+          TAGS: >
+            type=sha
+            type=semver,pattern=v{{version}},value=${{ github.event.release.tag_name || github.event.inputs.tag }}
+            type=semver,pattern=v{{major}}.{{minor}},value=${{ github.event.release.tag_name || github.event.inputs.tag }}
+            type=semver,pattern=v{{major}},value=${{ github.event.release.tag_name || github.event.inputs.tag }}
+
       - name: Unpack Binaries
         run: |
           for filename in pkgx-*+*+*.tar.xz; do
@@ -47,13 +63,6 @@ jobs:
         with:
           path: src
 
-      - name: log in to github pkgs
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
       - name: log in to docker hub
         uses: docker/login-action@v3
         with:
@@ -63,16 +72,8 @@ jobs:
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images:
-            ghcr.io/${{ github.repository }}
-            pkgxdev/pkgx
-          tags: |
-            type=sha
-            type=ref,event=branch
-            type=semver,pattern=v{{version}}
-            type=semver,pattern=v{{major}}.{{minor}}
-            type=semver,pattern=v{{major}}
-            type=raw,value=latest
+          images: pkgxdev/pkgx
+          tags: ${{ steps.tags.outputs.value }}
 
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
@@ -87,4 +88,4 @@ jobs:
             $tags \
             --platform linux/amd64,linux/arm64 \
             --file ./src/.github/Dockerfile \
-            .
+            .
\ No newline at end of file
diff --git a/.github/workflows/cd.vx.yml b/.github/workflows/cd.vx.yml
index 65b3eea0..e5e48573 100644
--- a/.github/workflows/cd.vx.yml
+++ b/.github/workflows/cd.vx.yml
@@ -23,3 +23,4 @@ jobs:
       - run: |
           git tag -f latest
           git push origin latest --force
+        if: startsWith(github.event.release.tag_name, 2)
diff --git a/.github/workflows/cd.www.yml b/.github/workflows/cd.www.yml
index 6d6c889a..c68a1a9a 100644
--- a/.github/workflows/cd.www.yml
+++ b/.github/workflows/cd.www.yml
@@ -17,6 +17,7 @@ concurrency:
 
 jobs:
   www-upload:
+    if: startsWith(github.event.release.tag_name, 2)
     runs-on: ubuntu-latest
     steps:
       - uses: aws-actions/configure-aws-credentials@v4
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 20a07a68..edcff9f1 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -24,6 +24,3 @@ rusqlite = { version = "0.32.1", features = ["bundled"] }
 native-tls = { version = "0.2", features = ["vendored"] }
 # ^^ this is a transitive dependency
 # ^^ we vendor OpenSSL ∵ we want to be standalone and just work inside minimal docker images
-
-[profile.release]
-lto = "fat"
diff --git a/scripts/publish-release.sh b/scripts/publish-release.sh
index f0bf6fe9..f1af1113 100755
--- a/scripts/publish-release.sh
+++ b/scripts/publish-release.sh
@@ -1,7 +1,4 @@
-#!/usr/bin/env -S pkgx +git +gh +jq +gum +npx +deno bash -eo pipefail
-
-# the back and forth here is because draft releases cannot trigger
-# GitHub Actions 😒
+#!/usr/bin/env -S pkgx +git +gh +jq +gum bash -eo pipefail
 
 if ! git diff-index --quiet HEAD --; then
   echo "error: dirty working tree" >&2
@@ -13,39 +10,10 @@ if [ "$(git rev-parse --abbrev-ref HEAD)" != main ]; then
   exit 1
 fi
 
-# ensure we have the latest version tags
-git fetch origin -pft
-
-versions="$(git tag | grep '^v[0-9]\+\.[0-9]\+\.[0-9]\+')"
-v_latest="$(npx -- semver --include-prerelease $versions | tail -n1)"
-
-_is_prerelease() {
-  deno run - <<EoTS
-    import { parse } from "https://deno.land/x/semver/mod.ts";
-    console.log(parse('$1')?.prerelease.length ? 'true' : 'false');
-EoTS
-}
+v_new=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[] | select(.name == "pkgx") | .version')
 
-case $1 in
-major|minor|patch|prerelease)
-  v_new=$(npx -- semver bump $v_latest --increment $1)
-  ;;
-"")
-  echo "usage $0 <major|minor|patch|prerelease|VERSION>" >&2
-  exit 1;;
-*)
-  v_new=$1
-  ;;
-esac
-
-if [ $v_new = $v_latest ]; then
-  echo "$v_new already exists!" >&2
-  exit 1
-fi
-
-is_prerelease=$(_is_prerelease $v_new)
-
-if ! gh release view v$v_new >/dev/null 2>&1; then
+case $(gh release view --json isDraft | jq .isDraft) in
+'release not found')
   gum confirm "prepare draft release for $v_new?" || exit 1
 
   gh release create \
@@ -56,13 +24,17 @@ if ! gh release view v$v_new >/dev/null 2>&1; then
     --notes-start-tag=v$v_latest \
     --title=v$v_new
 
-  git push origin main
-else
+  ;;
+true)
   gum format "> existing $v_new draft found, using that"
   echo  #spacer
+  ;;
+false)
+  gum format "$v_new already published! edit \`./crates/cli/Cargo.toml\`"
+  exit 1;;
+esac
 
-  git push origin main
-fi
+git push origin main
 
 gh workflow run cd.yml --raw-field version="$v_new"
 # ^^ infuriatingly does not tell us the ID of the run