diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 742efbe..cec5a52 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -1,18 +1,31 @@
 # see https://github.com/viamrobotics/build-action for help
 on:
-  push:
-    tags:
-    - '[0-9]+.[0-9]+.[0-9]+'
+  release:
+    types: [published]
 
 jobs:
+  validate-tag:  # Make sure we're publishing a tag that looks like semantic versioning
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate tag format
+        run: |
+          TAG="${{ github.event.release.tag_name }}"
+          echo "Validating tag: '$TAG'"
+          if [[ $TAG =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]*)?$ ]]; then
+            echo "Tag matches semver."
+          else
+            echo "Error: tag does not match semver."
+            exit 1
+          fi
+
   publish:
     runs-on: ubuntu-latest
+    needs: [validate-tag]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - uses: viamrobotics/build-action@v1
       with:
-        # note: you can replace this line with 'version: ""' if you want to test the build process without deploying
-        version: ${{ github.ref_name }}
+        version: ${{ github.event.release.tag_name }}
         ref: ${{ github.sha }}
         key-id: ${{ secrets.viam_key_id }}
         key-value: ${{ secrets.viam_key_value }}