diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0e0225b..046720b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -3,6 +3,12 @@ name: release
 on:
   release:
     types: [published]
+  # Rebuilds the zip for a release that already exists and replaces its asset.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing release tag, e.g. v1.1.1'
+        required: true
 
 permissions:
   contents: write
@@ -62,6 +68,6 @@ jobs:
       - name: Publish package
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.ref_name }}
+          TAG: ${{ inputs.tag || github.ref_name }}
           REPO: ${{ github.repository }}
-        run: gh release upload -R $REPO $TAG ./Modules/WhiteLabel/build/WhiteLabel.zip
+        run: gh release upload --clobber -R $REPO $TAG ./Modules/WhiteLabel/build/WhiteLabel.zip
diff --git a/scripts/artifact-gen.sh b/scripts/artifact-gen.sh
index e60da53..231ada9 100755
--- a/scripts/artifact-gen.sh
+++ b/scripts/artifact-gen.sh
@@ -1,15 +1,22 @@
 #!/bin/bash
 
+# Stop at the first failure: without this a failed build still zipped the
+# module, and a release went out with no dist/ in it.
+set -euo pipefail
+
 # Get the directory of the current script
 SCRIPT_DIR="$(dirname "$(realpath "$0")")"
 
 # Navigate to the root of the module
 MODULE_ROOT="$(realpath "$SCRIPT_DIR/..")"
 
-# Build project
-cd "$MODULE_ROOT" || exit
-yarn
-yarn build
+# Build project. npm, not yarn: the module is built inside an InvoiceShelf
+# 2.x checkout whose package.json names pnpm as its packageManager, which
+# makes Yarn 1 refuse to run.
+cd "$MODULE_ROOT"
+npm install --no-audit --no-fund
+npm run build
+test -f dist/style.css || { echo "The build produced no dist/style.css" >&2; exit 1; }
 
 mkdir -p "$MODULE_ROOT/build/WhiteLabel"