diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 43969e28400a9f..902dad72b836ac 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,8 +29,11 @@ jobs:
       # Always run master branch builds to completion. This allows the cache to
       # stay mostly up-to-date in situations where a single job fails due to
       # e.g. a flaky test.
+      # Don't fast-fail on tag build because publishing binaries shouldn't be
+      # prevented if 'cargo publish' fails (which can be a false negative).
       fail-fast:
-        ${{ github.event_name != 'push' || github.ref != 'refs/heads/master' }}
+        ${{ github.event_name == 'pull_request' || (github.ref !=
+        'refs/heads/master' && !startsWith(github.ref, 'refs/tags/')) }}
 
     env:
       CARGO_INCREMENTAL: 0