diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9d35e93..b3d51a7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -212,6 +212,12 @@ jobs:
       - uses: actions/download-artifact@v8
         with:
           name: fallout-vsix
+      # The publish CLIs are dev dependencies, and IHasVsix.ResolveNodeTool looks for
+      # them in node_modules/.bin before PATH. --skip PackVsix below prunes the whole
+      # upstream chain — RestoreVsix ("npm ci") included, since nothing else needs it —
+      # so without this the tools are simply absent and PublishVsix dies resolving them.
+      - name: 'Install the Node toolchain'
+        run: npm ci
       # --skip PackVsix publishes the exact artifact that was packed and validated,
       # rather than rebuilding it here and publishing bits nothing has seen.
       - name: 'Fallout build (PublishVsix → vs-marketplace)'
@@ -247,6 +253,12 @@ jobs:
       - uses: actions/download-artifact@v8
         with:
           name: fallout-vsix
+      # The publish CLIs are dev dependencies, and IHasVsix.ResolveNodeTool looks for
+      # them in node_modules/.bin before PATH. --skip PackVsix below prunes the whole
+      # upstream chain — RestoreVsix ("npm ci") included, since nothing else needs it —
+      # so without this the tools are simply absent and PublishVsix dies resolving them.
+      - name: 'Install the Node toolchain'
+        run: npm ci
       - name: 'Fallout build (PublishVsix → open-vsx)'
         run: ./build.sh PublishVsix --publish-vsix-to open-vsx --skip PackVsix
         env:
diff --git a/docs/ci.md b/docs/ci.md
index d7df871..d9576ed 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -108,3 +108,4 @@ To run the extension itself rather than the build, see [developing.md](developin
 - **`PublicRelease: true`** is set on any job that checks out a tag. A detached HEAD matches none of `version.json`'s branch refspecs, so without it Nerdbank.GitVersioning appends a git-height suffix and the marketplace version stops being a clean triple.
 - **`fetch-depth: 0`** is required wherever the version is computed — NB.GV needs full history.
 - **Boolean workflow inputs arrive as strings** from the REST API, and therefore from `gh workflow run`. Conditions compare against both `true` and `'true'`; a bare `== true` silently skips while reporting success.
+- **`--skip PackVsix` prunes the whole upstream chain**, `RestoreVsix` included — nothing else needs it, so Fallout skips it too. The promotion jobs therefore install the Node toolchain themselves: `vsce` and `ovsx` are dev dependencies, and `IHasVsix.ResolveNodeTool` looks in `node_modules/.bin` before `PATH`. Without that step `PublishVsix` fails resolving its tools before it reaches a registry — which is exactly how the first promotion of v10.4.31 failed.