diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a30bc68..343c046 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,9 @@ on:
   # Allow manual trigger
   workflow_dispatch:
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   build:
     name: Build
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cddda6f..62eaa86 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,4 +22,5 @@ jobs:
       artifact-name: devtoolbox-macos-release-${{ github.run_id }}
       go-version-file: go.mod
       runner-label: macos-26
+      github-release-prerelease: ${{ contains(github.ref_name, '-') }}
     secrets: inherit
diff --git a/docs/MACOS_RELEASE.md b/docs/MACOS_RELEASE.md
index f0ed807..b77fd60 100644
--- a/docs/MACOS_RELEASE.md
+++ b/docs/MACOS_RELEASE.md
@@ -6,9 +6,12 @@ This project ships macOS releases as a signed, notarized, and stapled
 The first signed release is intentionally macOS-only. Linux and Windows release
 artifacts are skipped until a later release pass.
 
-Release tags use the normal stable project SemVer format, for example `v0.10.0`.
-The packaging script embeds the tag version into the macOS app bundle as
-`CFBundleShortVersionString` and `CFBundleVersion`.
+Release tags use normal project SemVer. Stable releases use tags such as
+`v0.10.0`; prereleases use tags such as `v0.10.0-rc.1`. The packaging script
+embeds the stable base version into the macOS app bundle as
+`CFBundleShortVersionString` and `CFBundleVersion`, so a prerelease tag like
+`v0.10.0-rc.1` embeds `0.10.0` in the app bundle and marks the GitHub Release
+as a prerelease.
 
 ## Required GitHub Secrets
 
diff --git a/scripts/package-macos-universal.sh b/scripts/package-macos-universal.sh
index e434e83..16d35de 100755
--- a/scripts/package-macos-universal.sh
+++ b/scripts/package-macos-universal.sh
@@ -4,13 +4,22 @@ set -euo pipefail
 app_name="${APP_NAME:-DevToolbox}"
 bin_dir="${BIN_DIR:-bin}"
 app_version="${APP_VERSION:-}"
+tag_version=""
 
-if [[ -z "$app_version" && "${GITHUB_REF_TYPE:-}" == "tag" ]]; then
-  app_version="${GITHUB_REF_NAME#v}"
+if [[ "${GITHUB_REF_TYPE:-}" == "tag" ]]; then
+  tag_version="${GITHUB_REF_NAME#v}"
+  if [[ ! "$tag_version" =~ ^[0-9]+[.][0-9]+[.][0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+    echo "Release tag must be stable or prerelease SemVer with a leading v; got: ${GITHUB_REF_NAME:-}" >&2
+    exit 1
+  fi
+fi
+
+if [[ -z "$app_version" && -n "$tag_version" ]]; then
+  app_version="${tag_version%%-*}"
 fi
 
 if [[ -n "$app_version" && ! "$app_version" =~ ^[0-9]+[.][0-9]+[.][0-9]+$ ]]; then
-  echo "APP_VERSION must be stable SemVer without a leading v; got: $app_version" >&2
+  echo "APP_VERSION must be stable SemVer without a leading v because Apple bundle versions do not include prerelease labels; got: $app_version" >&2
   exit 1
 fi