diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index eef6be0..3036e83 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -66,7 +66,7 @@ jobs:
   npm:
     needs: verify
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
     environment: npm
     permissions:
       contents: read
@@ -85,11 +85,20 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           TAG: ${{ github.ref_name }}
         run: |
-          if npm view "@pymodel/designer-skill-mcp@${TAG#v}" version >/dev/null 2>&1; then
-            echo "already on npm; skipping"
-          else
+          published() { npm view "@pymodel/designer-skill-mcp@${TAG#v}" version >/dev/null 2>&1; }
+          if [ -n "$NODE_AUTH_TOKEN" ]; then
+            if published; then echo "already on npm; skipping"; exit 0; fi
             npm publish ./pkg/*.tgz --provenance --access public --ignore-scripts
+            exit 0
           fi
+          # No token: release.sh PUBLISH_LOCAL=1 published it; npm processes uploads
+          # asynchronously, so wait for the version instead of racing it.
+          for _ in $(seq 60); do
+            if published; then echo "published locally; skipping"; exit 0; fi
+            sleep 10
+          done
+          echo "::error::${TAG#v} not on npm after 10 min and no NPM_TOKEN secret to publish it"
+          exit 1
 
   registry:
     needs: npm