diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 296463ef2..4506cc483 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -220,8 +220,11 @@ jobs:
   pypi-publish:   
     runs-on: ubuntu-latest
     needs: ['build', 'test-build']
+    # build must be checked too: when it is skipped or fails, test-build is
+    # skipped as well, which would otherwise let this job run.
     if: |
       always() &&
+      needs.build.result == 'success' &&
       (needs.test-build.result == 'success' || needs.test-build.result == 'skipped') && github.event.inputs.tag
     environment: 
       name: publish
@@ -265,8 +268,11 @@ jobs:
     outputs:
       image: ${{ steps.image.outputs.image }}
       digest: ${{ steps.build_container.outputs.digest }}
+    # build must be checked too: when it is skipped or fails, test-build is
+    # skipped as well, which would otherwise let this job run.
     if: |
       always() &&
+      needs.build.result == 'success' &&
       (needs.test-build.result == 'success' || needs.test-build.result == 'skipped') && github.event.inputs.tag
     env:
       CONTAINER_IMAGE: "ghcr.io/${{ github.repository }}"