diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 855aff9..f490561 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -22,6 +22,39 @@ jobs:
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 90
+    env:
+      ARTIFACT_GROUP_ID: uk.potatolab
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          ref: ${{ inputs.module-ref || github.sha }}
+          fetch-depth: 0 # the package version is derived from git history
+          filter: blob:none
+
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+        with:
+          distribution: zulu
+          java-version: '25'
+          cache-jdk: true
+
+      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb
+        with:
+          cache-provider: basic
+
+      - name: Build
+        env:
+          GRADLE_ARGS: ${{ inputs.gradle-args }}
+        run: |
+          read -r -a extra <<< "$GRADLE_ARGS"
+          bash ./gradlew build "${extra[@]}" --no-daemon --console=plain
+
+  publish:
+    # Runs only after the build above passed. The Maven credentials exist in this job and nowhere else,
+    # so a pull request build can never read them.
+    needs: build
+    if: ${{ github.event_name == 'push' || inputs.publish == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
     env:
       ARTIFACT_GROUP_ID: uk.potatolab
       MAVEN_USER: ${{ secrets.MAVEN_USER }}
@@ -45,12 +78,16 @@ jobs:
         with:
           cache-provider: basic
 
-      - name: Build
+      - name: Check the publish credentials
+        run: |
+          if [[ -z "$MAVEN_USER" || -z "$MAVEN_PASSWORD" ]]; then
+            echo "::error::MAVEN_USER and MAVEN_PASSWORD are not set; cannot publish"
+            exit 1
+          fi
+
+      - name: Publish
         env:
-          PUBLISH: ${{ github.event_name == 'push' || inputs.publish == 'true' }}
           GRADLE_ARGS: ${{ inputs.gradle-args }}
         run: |
-          tasks=(build)
-          [[ "$PUBLISH" == 'true' ]] && tasks+=(publish)
           read -r -a extra <<< "$GRADLE_ARGS"
-          bash ./gradlew "${tasks[@]}" "${extra[@]}" --no-daemon --console=plain
+          bash ./gradlew publish "${extra[@]}" --no-daemon --console=plain