diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 41e5c31..88b7812 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,12 +35,12 @@ jobs:
 
       - name: Validate OSS release surface
         run: |
+          pnpm build
           pnpm lint
           pnpm public:copy-scan
           pnpm public:portability-guard
           pnpm public:git-surface
           pnpm test
-          pnpm build
           pnpm oss:validate
           pnpm public:smoke
           pnpm --filter @martinloop/mcp lint
diff --git a/scripts/tests/root-release-workflow.test.mjs b/scripts/tests/root-release-workflow.test.mjs
index 66a377c..fa10b7f 100644
--- a/scripts/tests/root-release-workflow.test.mjs
+++ b/scripts/tests/root-release-workflow.test.mjs
@@ -26,6 +26,10 @@ test("root release workflow uses GitHub Actions trusted publishing without npm t
   assert.match(workflow, /pnpm --filter @martinloop\/mcp mcpb:smoke/);
   assert.match(workflow, /packages\/mcp\/dist-mcpb\/martinloop-\*\.mcpb/);
   assert.match(workflow, /packages\/mcp\/dist-mcpb\/martinloop-\*\.mcpb\.sha256/);
+  assert.ok(
+    workflow.indexOf("pnpm build") < workflow.indexOf("pnpm lint"),
+    "the clean release runner must build workspace type declarations before linting"
+  );
 
   assert.doesNotMatch(workflow, /NODE_AUTH_TOKEN/);
   assert.doesNotMatch(workflow, /NPM_TOKEN/);