diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0a3ae8f..ddda818 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -34,6 +34,13 @@ jobs:
     env:
       CARGO_TERM_COLOR: always
       CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+      # The repo's .cargo/config.toml sets `target-cpu=native` for local M1 dev.
+      # On GitHub's heterogeneous shared-runner fleet that flag makes rustc emit
+      # instructions the underlying (often live-migrated) silicon can't execute,
+      # so the verification build dies with SIGILL. Every other workflow
+      # (ci/release/bench) overrides it with a portable baseline; publish.yml was
+      # the one that didn't. Match them so the publish gate is reproducible.
+      RUSTFLAGS: "-C target-cpu=x86-64-v2"
 
     steps:
       - name: Checkout