diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f89686b..2885818 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -124,11 +124,13 @@ jobs:
           if-no-files-found: error
 
   publish:
-    # Publishes the crate to crates.io on a v* tag. Trusted publishing
+    # Publishes the crate to crates.io on a release tag (a v* tag without
+    # a prerelease suffix: v0.2.0 publishes, v0.2.0-rc1 does not — release
+    # candidates are never published). Trusted publishing
     # (OIDC) is GitHub-Actions-only, so authentication goes through a
     # crates.io API token stored as the CARGO_REGISTRY_TOKEN secret,
     # scoped to the pkh crate.
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
     needs: build
     runs-on: ubuntu-latest
     container: