diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7f3ed39..046932e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -72,7 +72,7 @@ jobs:
             --generate-notes
 
   build-and-push-image:
-    if: github.event_name != 'pull_request'
+    if: github.event_name == 'release'
     needs: verify
     runs-on: ubuntu-latest
     permissions:
@@ -104,10 +104,3 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
-      - name: Make package public on ghcr.io
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api --method PATCH \
-            /orgs/orkait/packages/container/hyperstack \
-            -f visibility=public
diff --git a/tests/workflow-behaviour.test.ts b/tests/workflow-behaviour.test.ts
index d335a47..dabaa9e 100644
--- a/tests/workflow-behaviour.test.ts
+++ b/tests/workflow-behaviour.test.ts
@@ -17,8 +17,8 @@ test("publish workflow verifies the package across the supported OS and Bun matr
   assert.match(workflow, /needs:\s*verify/, "publish job should wait for the verification matrix");
   assert.match(
     workflow,
-    /if:\s*github\.event_name\s*!=\s*'pull_request'/,
-    "publish job should not push images from pull request runs",
+    /if:\s*github\.event_name\s*==\s*'release'/,
+    "publish job should only run on release events",
   );
   assert.match(workflow, /gh release create/, "workflow should auto-create a release on version bump");
 });