diff --git a/.github/workflows/hotfix-publish.yml b/.github/workflows/hotfix-publish.yml
new file mode 100644
index 0000000..9ffebbc
--- /dev/null
+++ b/.github/workflows/hotfix-publish.yml
@@ -0,0 +1,74 @@
+name: Hotfix Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version tag (e.g. 1.29.2-hotfix.1)'
+        required: true
+        type: string
+
+concurrency:
+  group: docker-publish
+  cancel-in-progress: false
+
+permissions: read-all
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      - name: Log in to GHCR
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ inputs.version }}
+            type=raw,value=latest
+
+      - name: Build and push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            APP_VERSION=${{ inputs.version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Set package visibility to public
+        run: |
+          curl -sf -X PATCH \
+            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+            -H "Accept: application/vnd.github.v3+json" \
+            "https://api.github.com/orgs/312-dev/packages/container/scrolly" \
+            -d '{"visibility":"public"}' || true
diff --git a/src/lib/components/ProgressBar.svelte b/src/lib/components/ProgressBar.svelte
index 42c50dd..b3036b3 100644
--- a/src/lib/components/ProgressBar.svelte
+++ b/src/lib/components/ProgressBar.svelte
@@ -39,6 +39,11 @@
 	// Track pointer type so we know whether to clear hover on end
 	let activePointerType: string | null = null;
 
+	/** Block native scroll/pull-to-refresh while scrubbing */
+	function blockTouchMove(e: TouchEvent) {
+		e.preventDefault();
+	}
+
 	function handlePointerDown(e: PointerEvent) {
 		e.preventDefault();
 		e.stopPropagation();
@@ -52,9 +57,11 @@
 		window.addEventListener('pointermove', handleWindowPointerMove);
 		window.addEventListener('pointerup', handleWindowPointerUp);
 		window.addEventListener('pointercancel', handleWindowPointerUp);
+		window.addEventListener('touchmove', blockTouchMove, { passive: false });
 	}
 
 	function handleWindowPointerMove(e: PointerEvent) {
+		e.preventDefault();
 		const t = getTimeFromX(e.clientX);
 		scrubTime = t;
 		onseek(t);
@@ -65,6 +72,7 @@
 		window.removeEventListener('pointermove', handleWindowPointerMove);
 		window.removeEventListener('pointerup', handleWindowPointerUp);
 		window.removeEventListener('pointercancel', handleWindowPointerUp);
+		window.removeEventListener('touchmove', blockTouchMove);
 		if (scrubTime !== null) onseek(scrubTime);
 		scrubbing = false;
 		scrubTime = null;