diff --git a/.changeset/config.json b/.changeset/config.json
index b420c038..e624ec46 100644
--- a/.changeset/config.json
+++ b/.changeset/config.json
@@ -1,13 +1,14 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@1.6.2/schema.json",
-  "changelog": [
-    "@changesets/changelog-github",
-    { "repo": "changesets/action" }
-  ],
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0-next.6/schema.json",
+  "changelog": "@changesets/changelog-github",
   "commit": false,
   "linked": [],
   "access": "restricted",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
-  "ignore": []
+  "ignore": [],
+  "privatePackages": {
+    "version": true,
+    "tag": true
+  }
 }
diff --git a/.changeset/pre.json b/.changeset/pre.json
index 86a5b19c..6b36ff58 100644
--- a/.changeset/pre.json
+++ b/.changeset/pre.json
@@ -1,9 +1,6 @@
 {
   "mode": "pre",
   "tag": "next",
-  "initialVersions": {
-    "@changesets/action": "1.9.0"
-  },
   "changesets": [
     "all-cars-grin",
     "eight-clocks-pull",
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bb8ca1a9..2054ba0d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,13 +15,38 @@ concurrency:
 permissions: {} # each job should define its own permission explicitly
 
 jobs:
+  select-mode:
+    name: Select mode
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    outputs:
+      mode: ${{ steps.select-mode.outputs.mode }}
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/ci-setup
+        with:
+          skip-cache: true # avoid cache poisoning attacks
+
+      - name: Build
+        run: pnpm build
+
+      - name: Select mode
+        id: select-mode
+        uses: ./select-mode
+
   version:
     name: Version
+    if: needs.select-mode.outputs.mode == 'version'
+    needs: select-mode
     runs-on: ubuntu-latest
     environment: version
     timeout-minutes: 20
-    outputs:
-      hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
     permissions:
       contents: read # to check out repo (actions/checkout)
     steps:
@@ -47,15 +72,15 @@ jobs:
 
       - name: Create or update release pull request
         id: changesets
-        uses: ./
+        uses: ./version
         with:
           github-token: ${{ steps.app-token.outputs.token }}
-          version: pnpm bump
+          script: pnpm bump
 
   publish:
     name: Publish
-    if: needs.version.outputs.hasChangesets == 'false'
-    needs: version
+    if: needs.select-mode.outputs.mode == 'publish'
+    needs: select-mode
     runs-on: ubuntu-latest
     environment: marketplace
     timeout-minutes: 20
@@ -82,7 +107,7 @@ jobs:
         run: pnpm build
 
       - name: Publish to marketplace
-        uses: ./
+        uses: ./publish
         with:
           github-token: ${{ steps.app-token.outputs.token }}
-          publish: pnpm release
+          script: pnpm release
diff --git a/package.json b/package.json
index 445b5a98..44ba8b21 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,7 @@
 {
   "name": "@changesets/action",
   "version": "2.0.0-next.2",
+  "private": true,
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -36,7 +37,7 @@
   },
   "devDependencies": {
     "@changesets/changelog-github": "^1.0.0-next.6",
-    "@changesets/cli": "^3.0.0-next.7",
+    "@changesets/cli": "^3.0.0-next.8",
     "@changesets/types": "^7.0.0-next.6",
     "@changesets/write": "^1.0.0-next.6",
     "@tsconfig/node24": "^24.0.4",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a579d303..c4996e2f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -66,8 +66,8 @@ importers:
         specifier: ^1.0.0-next.6
         version: 1.0.0-next.6
       '@changesets/cli':
-        specifier: ^3.0.0-next.7
-        version: 3.0.0-next.7
+        specifier: ^3.0.0-next.8
+        version: 3.0.0-next.8
       '@changesets/types':
         specifier: ^7.0.0-next.6
         version: 7.0.0-next.6
@@ -199,8 +199,8 @@ packages:
     resolution: {integrity: sha512-0ShCWgNt50xP0mryAYT8wtSkMUinG8uhxXgCgwHZ4UvJnR2f4ns8OsGAxYu8FIds7kHFdLOz7qX4YQ6AX4tVUA==}
     engines: {node: ^22.11 || ^24 || >=26}
 
-  '@changesets/cli@3.0.0-next.7':
-    resolution: {integrity: sha512-DuwcGhtFina59DCREvS6N97zlXyYqnbhnFO/PBHaX5+ZalYsLxfnbWiwrbosdmy9QBlnvkyqXPVN2TFPZXzJmw==}
+  '@changesets/cli@3.0.0-next.8':
+    resolution: {integrity: sha512-gfIPhBs1XNdgXhTJ+uhzfG8jHmMLnQNNL4Uwqxoniw/xmmVRbc9xGIeLniRsGY77RgdhWW0V1z1zVjTztgMQzQ==}
     engines: {node: ^22.11 || ^24 || >=26, npm: '>=10.9.0', pnpm: '>=10.0.0', yarn: '>=4.5.2'}
     hasBin: true
 
@@ -1543,7 +1543,7 @@ snapshots:
       '@changesets/get-github-info': 1.0.0-next.3
       '@changesets/types': 7.0.0-next.6
 
-  '@changesets/cli@3.0.0-next.7':
+  '@changesets/cli@3.0.0-next.8':
     dependencies:
       '@changesets/apply-release-plan': 8.0.0-next.7
       '@changesets/assemble-release-plan': 7.0.0-next.7
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 50b3a618..2ce51cd3 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -7,7 +7,7 @@ minimumReleaseAgeExclude:
   - "@changesets/assemble-release-plan@7.0.0-next.7"
   - "@changesets/changelog-git@1.0.0-next.6"
   - "@changesets/changelog-github@1.0.0-next.6"
-  - "@changesets/cli@3.0.0-next.7"
+  - "@changesets/cli@3.0.0-next.8"
   - "@changesets/config@4.0.0-next.6"
   - "@changesets/get-dependents-graph@3.0.0-next.6"
   - "@changesets/get-github-info@1.0.0-next.3"
diff --git a/scripts/bump.ts b/scripts/bump.ts
index aec658e8..bcec726b 100644
--- a/scripts/bump.ts
+++ b/scripts/bump.ts
@@ -1,12 +1,14 @@
 import fs from "node:fs";
 import path from "node:path";
 import { exec } from "@actions/exec";
-import pkgJson from "../package.json" with { type: "json" };
 
 process.chdir(path.join(import.meta.dirname, ".."));
 
 await exec("changeset", ["version"]);
 
+// read after versioning to get the new version
+const pkgJson = (await import("../package.json", { with: { type: "json" } }))
+  .default;
 const releaseLine = `v${pkgJson.version.split(".")[0]}`;
 
 const readmePath = path.join(import.meta.dirname, "..", "README.md");
diff --git a/scripts/release.ts b/scripts/release.ts
index cf955333..7d30fa10 100644
--- a/scripts/release.ts
+++ b/scripts/release.ts
@@ -1,6 +1,6 @@
 import { Buffer } from "node:buffer";
 import path from "node:path";
-import { exec, getExecOutput } from "@actions/exec";
+import { exec } from "@actions/exec";
 import pkgJson from "../package.json" with { type: "json" };
 
 const tag = `v${pkgJson.version}`;
@@ -20,37 +20,17 @@ const gitEnv = {
 
 process.chdir(path.join(import.meta.dirname, ".."));
 
-(async () => {
-  const { exitCode, stderr } = await getExecOutput(
-    `git`,
-    ["ls-remote", "--exit-code", "origin", "--tags", `refs/tags/${tag}`],
-    {
-      ignoreReturnCode: true,
-    },
-  );
-  if (exitCode === 0) {
-    console.log(
-      `Action is not being published because version ${tag} is already published`,
-    );
-    return;
-  }
-  if (exitCode !== 2) {
-    throw new Error(`git ls-remote exited with ${exitCode}:\n${stderr}`);
-  }
-
-  await exec("git", ["checkout", "--detach"]);
-  await exec("git", ["add", "--force", "dist"]);
-  await exec("git", ["commit", "-m", tag]);
+await exec("git", ["checkout", "--detach"]);
+await exec("git", ["add", "--force", "dist"]);
+await exec("git", ["commit", "-m", tag]);
 
-  await exec("changeset", ["git-tag"]);
-
-  if (isPrerelease) {
-    await exec("git", ["push", "origin", `refs/tags/${tag}`], {
-      env: gitEnv,
-    });
-    return;
-  }
+await exec("changeset", ["git-tag"]);
 
+if (isPrerelease) {
+  await exec("git", ["push", "origin", `refs/tags/${tag}`], {
+    env: gitEnv,
+  });
+} else {
   await exec(
     "git",
     [
@@ -64,4 +44,4 @@ process.chdir(path.join(import.meta.dirname, ".."));
       env: gitEnv,
     },
   );
-})();
+}