diff --git a/.github/workflows/release-package.yml b/.github/workflows/release-package.yml
index f24a60f..974f77c 100644
--- a/.github/workflows/release-package.yml
+++ b/.github/workflows/release-package.yml
@@ -43,6 +43,18 @@ jobs:
           else
             echo "tag=latest" >> $GITHUB_OUTPUT
           fi
+      ############# NPM PUBLISH ##############
+      - run: npm ci
+      - run: npm publish --tag ${{ steps.npm-tag.outputs.tag }}
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.NODE_AUTH_TOKEN}}
+      ############# GITHUB RELEASE ##############
+      # Tag + release only run after a successful publish, so a failed
+      # publish never leaves an orphaned tag that blocks reruns.
+      - name: Extract release notes
+        id: extract-release-notes
+        if: steps.npm-tag.outputs.tag == 'latest'
+        uses: ffurrer2/extract-release-notes@v1
       ############# TAG RELEASE ##############
       - name: 'Push tag v${{ steps.package-version.outputs.current-version }}'
         if: steps.npm-tag.outputs.tag == 'latest'
@@ -50,10 +62,6 @@ jobs:
         id: tag_version
         with:
           tag: 'v${{ steps.package-version.outputs.current-version }}'
-      ############# GITHUB RELEASE ##############
-      - name: Extract release notes
-        id: extract-release-notes
-        uses: ffurrer2/extract-release-notes@v1
       - name: 'Create a GitHub release v${{ steps.package-version.outputs.current-version }}'
         if: steps.npm-tag.outputs.tag == 'latest'
         uses: ncipollo/release-action@v1
@@ -62,7 +70,3 @@ jobs:
           name: 'Release v${{ steps.package-version.outputs.current-version }}'
           body: |
             ${{ steps.extract-release-notes.outputs.release_notes }}
-      - run: npm ci
-      - run: npm publish --tag ${{ steps.npm-tag.outputs.tag }}
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NODE_AUTH_TOKEN}}