diff --git a/templates/npm_projects.gitlab-ci.yml b/templates/npm_projects.gitlab-ci.yml
index 56fe843790cc330061e114daf28f64037604f77f..8ad877859e4cabc771f6ec8d36420e4c15168b1a 100644
--- a/templates/npm_projects.gitlab-ci.yml
+++ b/templates/npm_projects.gitlab-ci.yml
@@ -41,7 +41,17 @@ variables:
     NPM_REGISTRY_URL: "gitlab.syncad.com/api/v4/projects/${CI_PROJECT_ID}/packages/npm/"
 
   script:
-    - /home/emscripten/scripts/npm_build_package.sh "${SOURCE_DIR}" "${NPM_REGISTRY_URL}" "${NPM_PACKAGE_SCOPE}" "${NPM_PACKAGE_NAME}" "${DIST_DIR}"
+    - |
+      if [ "${CI_COMMIT_REF_PROTECTED}" == "true" ]; then
+        if [ -n "${CI_COMMIT_TAG}" ]; then
+          DIST_TAG="latest" # if package is built for protected tag, let's mark it as latest
+        else
+          DIST_TAG="stable" # otherwise, any build for protected branch will produce stable package
+        fi
+      else
+        DIST_TAG="dev"
+      fi
+      /home/emscripten/scripts/npm_build_package.sh "${SOURCE_DIR}" "${NPM_REGISTRY_URL}" "${NPM_PACKAGE_SCOPE}" "${NPM_PACKAGE_NAME}" "${DIST_DIR}" "${DIST_TAG}"
 
   artifacts:
     reports:
@@ -131,7 +141,7 @@ variables:
 
   script:
     # project version info must be regenerated accoring to correct target registry, package scope and name
-    - /home/emscripten/scripts/npm_generate_version.sh "${SOURCE_DIR}" "registry.npmjs.org/" "@hiveio" "${NPM_PACKAGE_NAME}"
+    - /home/emscripten/scripts/npm_generate_version.sh "${SOURCE_DIR}" "registry.npmjs.org/" "@hiveio" "${NPM_PACKAGE_NAME}" "latest"
     - echo -e "\e[0Ksection_start:$(date +%s):publishing[collapsed=false]\r\e[0KAttempting to publish a package to registry.npmjs.org..."
     - /home/emscripten/scripts/npm_publish.sh "${SOURCE_DIR}" "registry.npmjs.org/" "@hiveio" "${NPM_PUBLISH_TOKEN}"
     - echo -e "\e[0Ksection_end:$(date +%s):publishing\r\e[0KDone"