diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9bce958f9..52a0c8ec5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -385,7 +385,10 @@ jobs:
         # `.npmrc` that `setup-node` generates, and npm then fails `ENEEDAUTH`
         # before OIDC is ever attempted. Do not "restore" it.
         run: |
-          set -- release-tarball/*.tgz
+          # `./` is load-bearing: `npm publish` reads a bare `dir/file`
+          # argument as GitHub `owner/repo` shorthand and tries to clone it
+          # over SSH instead of publishing the local tarball (#2551).
+          set -- ./release-tarball/*.tgz
           if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then
             echo "Expected exactly one tarball in release-tarball/, found: $*"
             exit 1