diff --git a/.github/workflows/enable-auto-merge.yml b/.github/workflows/enable-auto-merge.yml
index bf28a02..02f5d33 100644
--- a/.github/workflows/enable-auto-merge.yml
+++ b/.github/workflows/enable-auto-merge.yml
@@ -1,16 +1,14 @@
 name: Auto-merge for Dependabot PRs
 
-on: pull_request_target
+on: pull_request
 
 permissions:
-  pull-requests: write
   contents: write
 
 jobs:
   enable-auto-merge:
-    if: ${{ github.actor == 'dependabot[bot]' }}
-    name: Enable auto-merge for Dependabot PRs
     runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
       - name: Enable auto-merge
         run: gh pr merge --auto --rebase "$PR_URL"
diff --git a/src/main.ts b/src/main.ts
index cecec4d..42e108f 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -164,7 +164,7 @@ async function main() {
     }
 
     core.startGroup('Validate version');
-    const versionRegEx = new RegExp(`^${prefixRegex}[0-9]+\\.[0-9]+\\.[0-9]+${suffixRegex}$`);
+    const versionRegEx = new RegExp(`^${prefixRegex}\d+\\.\d+\\.\d+${suffixRegex}$`);
     if (!versionRegEx.test(tag)) {
         const message = `Version tag ${tag} does not match (semver) regex ${versionRegEx.source}`;
         if (failOnNonSemVerTag) {
@@ -246,7 +246,7 @@ async function main() {
                 throw new Error(`Could not find an existing GitHub release for tag ${tag}`);
             }
 
-            // To mark the full release as latest, we simply update it by appending `&nbsp`.
+            // To mark the full release as latest, we simply update it by appending `&nbsp` and removing it again.
             const appendUpdate = {
                 owner: github.context.repo.owner,
                 repo: github.context.repo.repo,