diff --git a/.github/workflows/publish-pub.yml b/.github/workflows/publish-pub.yml
index b999083..c7fbc61 100644
--- a/.github/workflows/publish-pub.yml
+++ b/.github/workflows/publish-pub.yml
@@ -76,5 +76,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          flutter pub publish --dry-run
+          # Tolerates only the expected exact-pin warning for
+          # flutter_rust_bridge (see tool/check_pub_dry_run.sh).
+          tool/check_pub_dry_run.sh
           flutter pub publish --force
diff --git a/libfjs/cargokit.yaml b/libfjs/cargokit.yaml
index 77f9434..5543c07 100644
--- a/libfjs/cargokit.yaml
+++ b/libfjs/cargokit.yaml
@@ -22,6 +22,7 @@ precompiled_binaries:
     - tool/check_darwin_package_support.sh
     - tool/check_frb_codegen.sh
     - tool/check_frb_content_hash.dart
+    - tool/check_pub_dry_run.sh
   build_recipe:
     rust_toolchain: '1.97.1'
     flutter_version: '3.35.5'
diff --git a/tool/check_darwin_package_support.sh b/tool/check_darwin_package_support.sh
index 1bdad3c..6f4dea6 100755
--- a/tool/check_darwin_package_support.sh
+++ b/tool/check_darwin_package_support.sh
@@ -167,6 +167,7 @@ check_structure() {
   require_file "tool/build_fjs_xcframework.sh"
   require_file "tool/check_frb_content_hash.dart"
   require_file "tool/check_minimum_flutter_compatibility.sh"
+  require_file "tool/check_pub_dry_run.sh"
   require_file "tool/prepare_darwin_release.sh"
 
   require_contains "pubspec.yaml" "sharedDarwinSource: true"
@@ -244,7 +245,8 @@ check_structure() {
     tool/build_fjs_xcframework.sh \
     tool/check_darwin_package_support.sh \
     tool/check_frb_codegen.sh \
-    tool/check_frb_content_hash.dart; do
+    tool/check_frb_content_hash.dart \
+    tool/check_pub_dry_run.sh; do
     require_exact_line "libfjs/cargokit.yaml" "    - $hash_input"
   done
   require_exact_line "libfjs/cargokit.yaml" "    rust_toolchain: '1.97.1'"
@@ -338,8 +340,10 @@ fjs.xcframework.zip.checksum'
   require_not_contains "tool/build_fjs_xcframework.sh" 'assemble_fjs_xcframework.sh'
   require_contains "tool/prepare_darwin_release.sh" "--require-artifact"
   require_contains "tool/prepare_darwin_release.sh" "check_frb_codegen.sh"
-  require_contains "tool/prepare_darwin_release.sh" "flutter pub publish --dry-run"
-  require_contains "tool/prepare_darwin_release.sh" "should allow more than one version"
+  require_contains "tool/prepare_darwin_release.sh" "check_pub_dry_run.sh"
+  require_contains "tool/check_pub_dry_run.sh" "flutter pub publish --dry-run"
+  require_contains "tool/check_pub_dry_run.sh" "should allow more than one version"
+  require_contains ".github/workflows/publish-pub.yml" "tool/check_pub_dry_run.sh"
   require_contains "tool/check_frb_codegen.sh" "FRB_FMT_TOOLCHAIN=nightly"
   require_contains ".github/workflows/build-all-platforms.yml" \
     "rustup toolchain install nightly --profile minimal --component rustfmt"
diff --git a/tool/check_pub_dry_run.sh b/tool/check_pub_dry_run.sh
new file mode 100755
index 0000000..6214a4a
--- /dev/null
+++ b/tool/check_pub_dry_run.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+set -eu
+
+# Runs `flutter pub publish --dry-run` and enforces its warnings.
+#
+# The flutter_rust_bridge dependency is pinned to the exact codegen version
+# because FRB requires runtime == codegen at run time, so pub's "should
+# allow more than one version" warning for it is expected; it is the only
+# warning tolerated here. Any other warning or failure is fatal.
+
+ROOT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
+
+log="$(mktemp "${TMPDIR:-/tmp}/fjs-pub-dry-run.XXXXXX")"
+cleanup() {
+  rm -f "$log"
+}
+trap cleanup EXIT
+trap 'exit 130' HUP INT TERM
+
+status=0
+(cd "$ROOT_DIR" && flutter pub publish --dry-run) >"$log" 2>&1 || status=$?
+
+total_warnings="$(sed -nE 's/^Package has ([0-9]+) warnings?\.$/\1/p' "$log" | tail -n 1)"
+[ -n "$total_warnings" ] || total_warnings=0
+frb_pin_warnings="$(grep -c 'should allow more than one version' "$log" || true)"
+unexpected_warnings=$((total_warnings - frb_pin_warnings))
+
+if [ "$unexpected_warnings" -gt 0 ] ||
+  { [ "$status" -ne 0 ] && [ "$frb_pin_warnings" -eq 0 ]; } ||
+  grep -q '^Error' "$log"; then
+  cat "$log" >&2
+  echo "error: pub publish dry-run failed or reported unexpected warnings ($unexpected_warnings)" >&2
+  exit 1
+fi
diff --git a/tool/prepare_darwin_release.sh b/tool/prepare_darwin_release.sh
index ddfa7ff..9cb1747 100755
--- a/tool/prepare_darwin_release.sh
+++ b/tool/prepare_darwin_release.sh
@@ -86,26 +86,9 @@ RELEASE_TEMP_DIR=""
 
 pod ipc spec "$ROOT_DIR/darwin/fjs.podspec" >/dev/null
 
-# The runtime dependency is pinned to the exact FRB codegen version because
-# FRB enforces runtime == codegen at run time, so pub's "should allow more
-# than one version" warning for flutter_rust_bridge is expected; it is the
-# only warning this script tolerates. Anything else still fails the release.
-publish_log="$(mktemp "$ARTIFACT_DIR/.fjs-pub-dry-run.XXXXXX")"
-publish_status=0
-(cd "$ROOT_DIR" && flutter pub publish --dry-run) >"$publish_log" 2>&1 || publish_status=$?
-total_warnings="$(sed -nE 's/^Package has ([0-9]+) warnings?\.$/\1/p' "$publish_log" | tail -n 1)"
-[ -n "$total_warnings" ] || total_warnings=0
-frb_pin_warnings="$(grep -c 'should allow more than one version' "$publish_log" || true)"
-unexpected_warnings=$((total_warnings - frb_pin_warnings))
-if [ "$unexpected_warnings" -gt 0 ] ||
-  { [ "$publish_status" -ne 0 ] && [ "$frb_pin_warnings" -eq 0 ]; } ||
-  grep -q '^Error' "$publish_log"; then
-  cat "$publish_log" >&2
-  echo "error: pub publish dry-run failed or reported unexpected warnings ($unexpected_warnings)" >&2
-  rm -f "$publish_log"
-  exit 1
-fi
-rm -f "$publish_log"
+# Enforce the publish dry-run, tolerating only the expected exact-pin
+# warning for flutter_rust_bridge (see tool/check_pub_dry_run.sh).
+"$ROOT_DIR/tool/check_pub_dry_run.sh"
 
 echo "Darwin release artifact: $ARTIFACT_DIR/fjs.xcframework.zip"
 echo "SwiftPM checksum: $(cat "$ARTIFACT_DIR/fjs.xcframework.zip.checksum")"