diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 488acba..2cac7af 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -58,4 +58,8 @@ jobs:
         shell: bash
         env:
           NODE_AUTH_TOKEN: ''
+          # npm logs every OIDC token-exchange failure at verbose, so at the default
+          # loglevel a missing or mismatched trusted publisher just surfaces as
+          # ENEEDAUTH with no reason attached.
+          NPM_CONFIG_LOGLEVEL: verbose
 
diff --git a/scripts/publish-packages.sh b/scripts/publish-packages.sh
index 68a44f6..7fedc95 100755
--- a/scripts/publish-packages.sh
+++ b/scripts/publish-packages.sh
@@ -34,3 +34,16 @@ for manifest in packages/*/package.json; do
 done
 
 echo "published $published package(s)"
+
+# A run that publishes nothing is a failure, not a success. `lerna version` exits 0 when
+# it declines to version (an EBEHIND warning on a stale checkout, for example), which
+# leaves the manifests at their released versions and makes every package look already
+# published. Without this the job goes green having shipped nothing.
+if [ "$published" -eq 0 ]; then
+  echo "error: no packages were published." >&2
+  echo "The manifest versions above are already on the registry, so the Version step" >&2
+  echo "did not produce a new release. Check the Version step output rather than" >&2
+  echo "re-running this job: re-running a workflow checks out its original commit," >&2
+  echo "which still carries the pre-release versions." >&2
+  exit 1
+fi