diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d72ab09..96a3a0f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,5 +23,8 @@ jobs:
       - run: npm run lint
       - run: npm run build
       - run: npm test
-      # Prove the package builds and packs cleanly on every change, without publishing.
-      - run: npm publish --dry-run
+      # Prove the package packs cleanly on every change. npm pack rather than
+      # npm publish --dry-run, since newer npm rejects a publish dry-run whenever
+      # package.json holds an already released version, which is the normal state
+      # of every pull request between releases.
+      - run: npm pack --dry-run
diff --git a/README.md b/README.md
index fceb633..d1cab17 100644
--- a/README.md
+++ b/README.md
@@ -57,7 +57,7 @@ git push origin v0.0.2
 
 A plain tag (`v0.0.1`) publishes under `latest`. A prerelease tag (`v0.0.1-rc.1`)
 publishes under `next`, so it is opt-in and a bad one can be dropped without
-touching anyone on `latest`. Every pull request runs `npm publish --dry-run` on
+touching anyone on `latest`. Every pull request runs `npm pack --dry-run` on
 Windows, macOS and Linux, so packaging problems show up before a real release.
 
 The final package name is not fixed. `gaffa` is taken on npm, so the skeleton