diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 7c7da15..55bb7e0 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -284,12 +284,12 @@ jobs:
           } finally {
               try { Stop-Transcript -ErrorAction SilentlyContinue } catch {}
           }
-          # Persist exit code to a side-channel file so we can inspect even if
-          # the transcript got closed before the value was written.
           "code=$code at $(Get-Date)" | Out-File -FilePath publish-finish.log -Encoding ASCII
-          # Force explicit exit -- ignore any trailing $LASTEXITCODE noise from
-          # native commands above.
-          if ($code -ne 0) { exit $code } else { exit 0 }
+          # Match the build-job pattern: only exit non-zero on failure. Don't
+          # call `exit 0` -- PowerShell's natural end-of-script propagates the
+          # last $LASTEXITCODE (which is 0 after our final cmdlet).
+          $global:LASTEXITCODE = 0
+          if ($code -ne 0) { exit $code }
 
       - name: Pack + upload publish.tar.gz
         if: success()