diff --git a/.github/workflows/build-native.yml b/.github/workflows/build-native.yml
index 3fb4e9412..e526fa218 100644
--- a/.github/workflows/build-native.yml
+++ b/.github/workflows/build-native.yml
@@ -173,11 +173,11 @@ jobs:
         run: npm run build
 
       - name: Verify dist exists
-        run: test -f dist/loader.js || { echo "::error::dist/loader.js missing after build"; exit 1; }
+        run: test -s dist/loader.js || { echo "::error::dist/loader.js missing or empty after build"; exit 1; }
 
       - name: Verify tarball contents
         run: |
-          npm pack --dry-run 2>&1 | tee /tmp/pack-output.txt
+          npm pack --dry-run --ignore-scripts 2>&1 | tee /tmp/pack-output.txt
           grep -q "dist/loader.js" /tmp/pack-output.txt || {
             echo "::error::dist/loader.js not in tarball"
             exit 1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d9108d648..d8df723a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,7 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - Eliminated branch checkout during slice merge that caused STATE.md conflicts (#307)
 - Removed infinite delivery retry loop for background job completions (#301)
 - Display ⌥ instead of Alt for keybindings on macOS (#299)
+- Publish verification checks `dist/loader.js` is non-empty (`-s`) and uses `--ignore-scripts` on `npm pack --dry-run` to match actual publish behaviour (#298)
 
 ### Removed
 - Deprecated legacy dead code from OAuth module