diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml
index d6b1d184..7db0ab31 100644
--- a/.github/workflows/publish-cli.yml
+++ b/.github/workflows/publish-cli.yml
@@ -1,8 +1,14 @@
 name: Publish CLI
 
+# Dedicated tag, NOT the product "v*" release tag: the CLI depends on
+# @e2a/sdk, and the SDKs publish on their own ts-sdk-v* / python-v* tags
+# pushed after the product tag. Publishing the CLI from "v*" therefore
+# always raced ahead of the SDK it was built against (observed on v1.5.0:
+# @e2a/cli@2.2.0 hit npm ~4 minutes before @e2a/sdk@5.5.0). Push cli-v*
+# after ts-sdk-v* so the SDK is installable first.
 on:
   push:
-    tags: ["v*"]
+    tags: ["cli-v*"]
   workflow_dispatch:
 
 concurrency:
diff --git a/AGENTS.md b/AGENTS.md
index 226b71cc..5ae4ba49 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -437,7 +437,10 @@ manually on every API change even though the template won't remind you.
 - **Publishing** (all tag/dispatch-triggered GitHub workflows):
   - Python SDK: bump `sdks/python/pyproject.toml` version, tag `python-v*`.
   - TS SDK: bump `sdks/typescript/package.json` version, tag `ts-sdk-v*`.
-  - CLI: bump `cli/package.json` version, then GitHub release publish or
-    `gh workflow run "Publish CLI" --ref main`.
+  - CLI: bump `cli/package.json` version, tag `cli-v*` (or
+    `gh workflow run "Publish CLI" --ref main`). Deliberately NOT the
+    product `v*` tag: the CLI depends on `@e2a/sdk`, so push `cli-v*`
+    only after `ts-sdk-v*` — publishing from the product tag raced the
+    CLI onto npm before its SDK existed.
   - MCP: hosted-only — `publish-mcp-http.yml` pushes the HTTP image on tag;
     npm publish is retired.