diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e91c9e6..40cbac8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,8 +35,7 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: '3.11'
-      - run: pnpm install --frozen-lockfile --ignore-scripts
-      - run: pnpm exec electron-rebuild -f -w better-sqlite3
+      - run: pnpm install --frozen-lockfile
       - run: pnpm release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/scripts/tag.mjs b/scripts/tag.mjs
index 0fa0db3..371a70a 100644
--- a/scripts/tag.mjs
+++ b/scripts/tag.mjs
@@ -14,6 +14,7 @@ if (!['patch', 'minor', 'major'].includes(bump)) {
 }
 
 const exec = (cmd, opts = {}) => execSync(cmd, { stdio: 'inherit', ...opts })
+const read = (cmd) => execSync(cmd, { encoding: 'utf8' }).trim()
 
 // Ensure working tree is clean
 try {
@@ -23,6 +24,20 @@ try {
   process.exit(1)
 }
 
+const branch = read('git branch --show-current')
+if (branch !== 'main') {
+  console.error('Releases must be tagged from main after the version bump is ready to publish.')
+  process.exit(1)
+}
+
+exec('git fetch origin main')
+const localHead = read('git rev-parse HEAD')
+const remoteHead = read('git rev-parse origin/main')
+if (localHead !== remoteHead) {
+  console.error('Local main must match origin/main before tagging. Pull or push your changes first.')
+  process.exit(1)
+}
+
 // Bump version in package.json only, no git tag
 exec(`npm version ${bump} --no-git-tag-version`)
 
@@ -32,6 +47,7 @@ const tag = `v${version}`
 // Commit the bump locally, then tag that commit
 exec(`git add package.json`)
 exec(`git commit -m "chore: bump version to ${tag}"`)
+exec('git push origin main')
 exec(`git tag ${tag}`)
 
 // Push the tag (triggers CI) — tags are not subject to branch rules
@@ -39,8 +55,4 @@ exec(`git push origin ${tag}`)
 
 console.log(`
 Tag ${tag} pushed. CI will build and publish the release.
-
-The version bump commit is local. Push it to main:
-  - If you can push directly: git push
-  - Otherwise open a PR from your current branch
 `)