diff --git a/.coding-ci.yaml b/.coding-ci.yaml
index 6575a8f5..c27de9c6 100644
--- a/.coding-ci.yaml
+++ b/.coding-ci.yaml
@@ -97,7 +97,10 @@ stages:
         - "echo \"//r.tnpm.oa.com/:_auth=$(echo -n \"${NPM_USERNAME}:${NPM_TOKEN}\" | base64)\" > .npmrc"
         - npm ci --ignore-scripts
         - npm run build
-        - npm publish --registry http://r.tnpm.oa.com
+        # Resolve the dist-tag from the version: a prerelease (e.g. 0.21.0-beta.0)
+        # publishes to its own channel (beta/rc/...), never to `latest` — the tag
+        # the CLI's auto-update check reads for @tencent/teamai-cli (src/update.ts).
+        - "PKG_VERSION=$(node -p \"require('./package.json').version\")\ncase \"$PKG_VERSION\" in\n  *-*)\n    PRE=\"${PKG_VERSION#*-}\"\n    DIST_TAG=\"${PRE%%.*}\"\n    case \"$DIST_TAG\" in\n      ''|*[!a-zA-Z]*) DIST_TAG=\"beta\" ;;\n    esac\n    ;;\n  *)\n    DIST_TAG=\"latest\"\n    ;;\nesac\necho \"Publishing $PKG_VERSION with dist-tag: $DIST_TAG\"\nnpm publish --registry http://r.tnpm.oa.com --tag \"$DIST_TAG\"\n"
         - rm -f .npmrc
 trigger:
   branches:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d1f8efb9..138e5afd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -47,8 +47,36 @@ jobs:
       - name: Build
         run: npm run build
 
+      - name: Resolve dist-tag
+        id: disttag
+        run: |
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          case "$PKG_VERSION" in
+            *-*)
+              # Prerelease (e.g. 0.21.0-beta.0). Derive the dist-tag from the
+              # first prerelease identifier (beta, rc, alpha, ...) so it lands
+              # on its own channel and NEVER on `latest` — the tag consumed by
+              # the CLI's auto-update check (src/update.ts).
+              PRE="${PKG_VERSION#*-}"
+              DIST_TAG="${PRE%%.*}"
+              # npm rejects dist-tags that look like a semver version, so fall
+              # back to `beta` when the identifier isn't a plain word.
+              case "$DIST_TAG" in
+                ''|*[!a-zA-Z]*) DIST_TAG="beta" ;;
+              esac
+              IS_PRERELEASE=true
+              ;;
+            *)
+              DIST_TAG="latest"
+              IS_PRERELEASE=false
+              ;;
+          esac
+          echo "Publishing $PKG_VERSION with dist-tag: $DIST_TAG (prerelease=$IS_PRERELEASE)"
+          echo "dist_tag=$DIST_TAG" >> "$GITHUB_OUTPUT"
+          echo "is_prerelease=$IS_PRERELEASE" >> "$GITHUB_OUTPUT"
+
       - name: Publish
-        run: npm publish --provenance --access public
+        run: npm publish --provenance --access public --tag "${{ steps.disttag.outputs.dist_tag }}"
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
@@ -56,3 +84,4 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           generate_release_notes: true
+          prerelease: ${{ steps.disttag.outputs.is_prerelease == 'true' }}
diff --git a/CLAUDE.md b/CLAUDE.md
index 844cbc14..dbe6e6bb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -47,6 +47,8 @@ git push origin main --tags
 
 CI stages: validate (lint + test) -> build -> e2e -> publish (tag builds only).
 
+Prerelease versions (`npm version prerelease --preid=beta` → `0.21.0-beta.0`) publish to a matching dist-tag (`beta`, `rc`, ...) instead of `latest`, so auto-update is unaffected.
+
 ## Git Conventions
 
 - **Default branch**: `main` (not `master`). All worktrees and PRs should be based on `origin/main`.