diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3201d50..403d38e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -31,7 +31,14 @@ jobs:
       - name: Verify build
         run: node bin/hookmyapp.js --version
       - name: Publish to npm (OIDC + provenance)
+        # prepublishOnly reruns the build during `npm publish`; keep the same
+        # env as the Build step so the rebuild bakes identical release values.
         run: npm publish --provenance --access public
+        env:
+          HOOKMYAPP_SENTRY_DSN: ${{ secrets.HOOKMYAPP_CLI_SENTRY_DSN }}
+          HOOKMYAPP_CLI_RELEASE: ${{ github.ref_name }}
+          HOOKMYAPP_POSTHOG_TOKEN: ${{ secrets.HOOKMYAPP_POSTHOG_TOKEN }}
+          HOOKMYAPP_POSTHOG_HOST: ${{ secrets.HOOKMYAPP_POSTHOG_HOST }}
 
   notify-failure:
     needs: [publish]
diff --git a/package-lock.json b/package-lock.json
index 3fe42d8..b42cbdd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@gethookmyapp/cli",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@gethookmyapp/cli",
-      "version": "0.13.0",
+      "version": "0.13.1",
       "license": "MIT",
       "dependencies": {
         "@inquirer/prompts": "^7.0.0",
diff --git a/package.json b/package.json
index 07f9980..7947b44 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gethookmyapp/cli",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "HookMyApp CLI, No BS. Just go live.",
   "type": "module",
   "bin": {
@@ -8,6 +8,7 @@
   },
   "scripts": {
     "build": "node build.mjs",
+    "prepublishOnly": "npm run build && npm run test:unit",
     "dev": "tsx src/index.ts",
     "test": "vitest run --reporter=verbose",
     "test:unit": "vitest run --reporter=verbose",