diff --git a/.github/workflows/publish-github-npm.yml b/.github/workflows/publish-github-npm.yml
index 052c5fb..8d20fef 100644
--- a/.github/workflows/publish-github-npm.yml
+++ b/.github/workflows/publish-github-npm.yml
@@ -49,8 +49,8 @@ jobs:
         run: |
           npm install --prefix verified --ignore-scripts --no-audit --no-fund --package-lock=false "./publish/supermax92-qgraphflow-$VERSION.tgz"
           diff -r runtime verified/node_modules/@supermax92/qgraphflow
-          node verified/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/validate-graph.mjs verified/node_modules/@supermax92/qgraphflow/examples/jeepay/flowchart.graph.json --input-only
-          node verified/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/generate-viewer.mjs verified/node_modules/@supermax92/qgraphflow/examples/jeepay/flowchart.graph.json output/order
+          node verified/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/validate-graph.mjs examples/jeepay/flowchart.graph.json --input-only
+          node verified/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/generate-viewer.mjs examples/jeepay/flowchart.graph.json output/order
           # Generate the complete real-source Jeepay collection with the installed package.
           node verified/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/generate-viewer.mjs examples/jeepay/collection.graph.json output/eleven
       - uses: actions/setup-node@v7
@@ -71,7 +71,7 @@ jobs:
           cmp "publish/supermax92-qgraphflow-$VERSION.tgz" "downloaded/supermax92-qgraphflow-$VERSION.tgz"
           npm install --prefix registry-check --registry=https://npm.pkg.github.com --ignore-scripts --no-audit --no-fund --package-lock=false "@supermax92/qgraphflow@$VERSION"
           diff -r runtime registry-check/node_modules/@supermax92/qgraphflow
-          node registry-check/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/generate-viewer.mjs registry-check/node_modules/@supermax92/qgraphflow/examples/jeepay/flowchart.graph.json output/registry
+          node registry-check/node_modules/@supermax92/qgraphflow/skills/q-flow/scripts/generate-viewer.mjs examples/jeepay/flowchart.graph.json output/registry
 
   # npmjs.com: the Release tarball itself, published through npm trusted publishing (GitHub OIDC) with provenance.
   # No npm token is stored anywhere; npmjs.com trusts this repository and this workflow file name.
diff --git a/tests/plugin-package.test.mjs b/tests/plugin-package.test.mjs
index a33893d..a0ddbdf 100644
--- a/tests/plugin-package.test.mjs
+++ b/tests/plugin-package.test.mjs
@@ -70,6 +70,7 @@ test('the npmjs job publishes the verified Release tarball through trusted publi
   const away = job.indexOf('cd "$RUNNER_TEMP/npx"'), npx = job.indexOf('npx -y "qgraphflow@$VERSION"');
   assert.ok(away > 0 && away < npx, 'npx runs outside the checkout, whose own package.json would shadow the registry package');
   assert.doesNotMatch(workflow, /NPM_TOKEN|secrets\./, 'No stored npm token');
+  assert.doesNotMatch(workflow, /qgraphflow\/examples\//, 'Examples are not packaged; read them from the checkout');
   assert.doesNotMatch(job, /NODE_AUTH_TOKEN|packages: write/);
   assert.ok(fs.existsSync(path.join(root, 'examples/jeepay/flowchart.graph.json')));
 });