@@ -260,7 +260,19 @@ jobs:
             NPM_TAG=$(node ../scripts/determine-npm-tag.js "$PUBLISHED_VERSION" "$THIS_VERSION")
           fi
 
-          yarn lerna publish from-package --tag-version-prefix='' --dist-tag $NPM_TAG --concurrency 1 --yes
+          # Rekor sometimes records a provenance entry but fails the response; the client's
+          # internal retry then gets a 409 and aborts. from-package skips already-published
+          # packages, and each attempt signs with a fresh certificate, so retrying is safe.
+          for attempt in 1 2 3; do
+            if yarn lerna publish from-package --tag-version-prefix='' --dist-tag $NPM_TAG --concurrency 1 --yes; then
+              break
+            fi
+            if [ "$attempt" = "3" ]; then
+              exit 1
+            fi
+            echo "Publish attempt $attempt failed, retrying in 15s..."
+            sleep 15
+          done
 
           LERNA_VERSION=$(node -p "require('./lerna.json').version")
           NEW_VERSION=$(node -p "require('./shared-lib/package.json').version")