diff --git a/.distignore b/.distignore
index 9fe2938..6d90744 100644
--- a/.distignore
+++ b/.distignore
@@ -11,6 +11,11 @@
 /.gitignore
 /.gitattributes
 /.distignore
+# Local build artefacts — CI never sees these (checkout is tracked files
+# only), but a local `wp dist-archive` would otherwise sweep them in.
+*.zip
+/build
+
 /tests
 /README.md
 /CHANGELOG.md
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 88e3522..d68c4bb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,20 +40,31 @@ jobs:
 
       - name: Assemble the plugin folder
         run: |
-          mkdir -p build/"$SLUG"
+          # Staged OUTSIDE the checkout on purpose. Building into ./build meant
+          # rsync copied ./ while build/ already existed inside it, sweeping the
+          # staging directory into the zip (shipped empty in 0.1.2).
+          mkdir -p "$RUNNER_TEMP/stage/$SLUG"
           # rsync honours .distignore directly: it skips blank lines and #
           # comments, and a leading / anchors to the transfer root, exactly as
           # `wp dist-archive` reads it. One source of truth for what ships.
-          rsync -a --exclude-from=.distignore ./ build/"$SLUG"/
+          rsync -a --exclude-from=.distignore ./ "$RUNNER_TEMP/stage/$SLUG/"
 
       - name: Show what is being shipped
-        run: find build -type f | sort
+        run: find "$RUNNER_TEMP/stage" | sort
+
+      - name: Fail if anything unwanted crept in
+        run: |
+          cd "$RUNNER_TEMP/stage"
+          if find . -type d \( -name build -o -name stage -o -name tests -o -name .git \) | grep -q .; then
+            echo "::error::Staging directory contains a folder that should not ship."
+            exit 1
+          fi
 
       - name: Create the zip
         run: |
           VERSION="${GITHUB_REF_NAME#v}"
-          cd build
-          zip -r "../$SLUG-$VERSION.zip" "$SLUG"
+          cd "$RUNNER_TEMP/stage"
+          zip -r "$GITHUB_WORKSPACE/$SLUG-$VERSION.zip" "$SLUG"
 
       - name: Attach it to the release
         if: startsWith(github.ref, 'refs/tags/v')