diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9e5f26f..613dff4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,66 +1,63 @@
 name: release
 
-permissions:
-  id-token: write
-  contents: write
-  actions: read
-
 on:
   push:
     tags:
       - 'v*'
 
-jobs:
-  ci:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          cache: pnpm
-
-      - run: pnpm install
-      - run: pnpm lint
-      - run: pnpm prepack
-      - run: pnpm test
+# Remove default permissions of GITHUB_TOKEN for security
+# https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
+permissions: {}
 
+jobs:
   release:
-    needs: ci
+    concurrency:
+      group: release
+    permissions:
+      contents: write
+      id-token: write
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+
+      - run: corepack enable
+
+      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
-          node-version: 24
-          cache: pnpm
-          registry-url: 'https://registry.npmjs.org'
+          node-version: latest
+          registry-url: 'https://registry.npmjs.org/'
+
+      - name: 📦 Install dependencies
+        run: pnpm install
+
+      - name: Build (stub)
+        run: pnpm dev:prepare
 
-      - run: pnpm install
-      - run: pnpm prepack
+      - name: 🛠 Build project
+        run: pnpm prepack
 
-      - name: Determine npm tag
+      - name: 🏷 Determine npm tag
         id: npm-tag
+        shell: bash
         run: |
           TAG="${GITHUB_REF#refs/tags/v}"
           if [[ "$TAG" == *"-alpha"* ]]; then
-            echo "tag=alpha" >> $GITHUB_OUTPUT
+            echo "tag=alpha" >> "$GITHUB_OUTPUT"
           elif [[ "$TAG" == *"-beta"* ]]; then
-            echo "tag=beta" >> $GITHUB_OUTPUT
+            echo "tag=beta" >> "$GITHUB_OUTPUT"
           elif [[ "$TAG" == *"-rc"* ]]; then
-            echo "tag=rc" >> $GITHUB_OUTPUT
+            echo "tag=rc" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=latest" >> $GITHUB_OUTPUT
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: GitHub Release
+      - name: 📝 GitHub Release
         run: pnpm dlx changelogithub
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Publish to npm
-        run: npm publish --provenance --access public --tag ${{ steps.npm-tag.outputs.tag }}
+      - name: 📦 Release
+        run: pnpm publish --no-git-checks --access public --tag ${{ steps.npm-tag.outputs.tag }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
deleted file mode 100644
index c93d3cf..0000000
--- a/CHANGELOG.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Changelog
-
-This changelog is incomplete for alpha releases. Use the GitHub Releases page for full history.
-
-## 0.0.2-alpha.0
-
-### Fixed
-
-- Fixed hardcoded paths in published package (0.0.1 was published with stub build)
diff --git a/package.json b/package.json
index 48f2fba..ffc14e9 100644
--- a/package.json
+++ b/package.json
@@ -57,7 +57,7 @@
     "dev:prepare": "nuxt-module-build build --stub && nuxi prepare playground",
     "dev:docs": "nuxi dev docs",
     "build:docs": "nuxi build docs",
-    "release": "bumpp --push --no-push-all",
+    "release": "bumpp --push",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "typecheck": "vue-tsc --noEmit",