diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e60adb5..46d5995 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,7 +22,7 @@ jobs:
       - name: Upgrade npm
         run: npm install -g npm@latest
 
-      - run: yarn
+      - run: yarn install --frozen-lockfile
       - run: yarn build
 
       - run: yarn version --no-git-tag-version --new-version ${{ github.event.release.name }}
@@ -42,6 +42,30 @@ jobs:
             echo "dist_tag=latest" >> "$GITHUB_OUTPUT"
           fi
 
+      # The example is installed and built before either publish step, for two
+      # reasons:
+      #   1. Fail fast. Publishing is irreversible (npm refuses to reuse a
+      #      version), so a broken example should stop the release rather than
+      #      leaving a published package with no matching Pages deploy.
+      #   2. `setup-node` only writes an .npmrc, and exports
+      #      NPM_CONFIG_USERCONFIG pointing at it, when given `registry-url`,
+      #      and it never unsets that for subsequent steps. The .npmrc it writes
+      #      always contains a literal `_authToken=${NODE_AUTH_TOKEN}`, and as of
+      #      v7 the action no longer exports a dummy token when none is supplied
+      #      (actions/setup-node#1558). yarn v1 hard-errors on the unresolved
+      #      placeholder ("Failed to replace env in config"), so the example must
+      #      not run after a `registry-url` step. Ordering it first leaves it on
+      #      the default public registry with no .npmrc involved at all.
+      - name: install example dependencies
+        working-directory: ./example
+        run: yarn install --frozen-lockfile
+
+      - name: build example site
+        working-directory: ./example
+        run: yarn build
+        env:
+          PUBLIC_URL: '/monaco-sql-languages'
+
       - name: Publish to npm (trusted publishing)
         run: npm publish --tag ${{ steps.determine_dist_tag.outputs.dist_tag }}
 
@@ -55,26 +79,6 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}
 
-      # Point the registry back at the public npm registry for the example install.
-      # `setup-node` exports NPM_CONFIG_USERCONFIG for the remainder of the job when
-      # `registry-url` is given, and it never unsets it, so a bare `setup-node` here
-      # would leave the private registry in effect. Passing an explicit `registry-url`
-      # rewrites that same .npmrc with the public registry instead.
-      - uses: actions/setup-node@v7
-        with:
-          node-version: '24.x'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: install example dependencies
-        working-directory: ./example
-        run: yarn
-
-      - name: build example site
-        working-directory: ./example
-        run: yarn build
-        env:
-          PUBLIC_URL: '/monaco-sql-languages'
-
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v4.1.0
         with: