diff --git a/.github/workflows/canary-release.yml b/.github/workflows/canary-release.yml
index 8a1283f0727..9d9cf795346 100644
--- a/.github/workflows/canary-release.yml
+++ b/.github/workflows/canary-release.yml
@@ -88,7 +88,6 @@ jobs:
       CANARY_VERSION: ${{ needs.prepare.outputs.version }}
       CANARY_TAG: ${{ needs.prepare.outputs.tag }}
       CANARY_PUBLISHED_AT: ${{ needs.prepare.outputs.published_at }}
-      KIMI_CODE_CANARY_NPM_PUBLISH: ${{ vars.KIMI_CODE_CANARY_NPM_PUBLISH }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -103,7 +102,6 @@ jobs:
       - name: Reject stale publish
         run: node scripts/canary-release.mjs guard
       - name: Publish to npm (canary dist-tag)
-        if: vars.KIMI_CODE_CANARY_NPM_PUBLISH == 'true'
         run: |
           if npm view "@moonshot-ai/kimi-code@$CANARY_VERSION" version >/dev/null 2>&1; then
             echo "@moonshot-ai/kimi-code@$CANARY_VERSION is already on npm"
diff --git a/scripts/canary-release.mjs b/scripts/canary-release.mjs
index 98df4886bd9..fb35c2fc377 100644
--- a/scripts/canary-release.mjs
+++ b/scripts/canary-release.mjs
@@ -207,16 +207,19 @@ function version() {
   }
 }
 
+export function readNpmCanaryVersion(execute = execFileSync) {
+  const npmLatest = execute('npm', ['view', PACKAGE_NAME, 'dist-tags.canary'], { encoding: 'utf8' }).trim();
+  if (npmLatest !== '' && parseCanaryVersion(npmLatest) === null) {
+    throw new Error(`npm canary tag is malformed: ${npmLatest}`);
+  }
+  return npmLatest;
+}
+
 function guard() {
   git(['fetch', '--tags', 'origin']);
   const publishedVersions = canaryVersions(canaryTags());
-  if (process.env.KIMI_CODE_CANARY_NPM_PUBLISH === 'true') {
-    const npmLatest = execFileSync('npm', ['view', PACKAGE_NAME, 'dist-tags.canary'], { encoding: 'utf8' }).trim();
-    if (npmLatest !== '') {
-      if (parseCanaryVersion(npmLatest) === null) throw new Error(`npm canary tag is malformed: ${npmLatest}`);
-      publishedVersions.push(npmLatest);
-    }
-  }
+  const npmLatest = readNpmCanaryVersion();
+  if (npmLatest !== '') publishedVersions.push(npmLatest);
   const version = env('CANARY_VERSION');
   const newer = findNewerCanaryVersion(version, publishedVersions);
   if (newer !== null) throw new Error(`stale canary run: ${version} would replace newer ${newer}`);
diff --git a/scripts/canary-release.test.mjs b/scripts/canary-release.test.mjs
index 76af02569a5..881d3b247e3 100644
--- a/scripts/canary-release.test.mjs
+++ b/scripts/canary-release.test.mjs
@@ -15,6 +15,7 @@ import {
   PACKAGE_NAME,
   parseCanaryVersion,
   readCanaryRelease,
+  readNpmCanaryVersion,
   requiredCanaryReleaseAssets,
   resolveCanaryBaseVersion,
   selectCanaryCommit,
@@ -228,3 +229,19 @@ await test('an older canary run is stale after a newer run publishes', () => {
   assert.equal(findNewerCanaryVersion(CANARY, [older, newer]), newer);
   assert.equal(findNewerCanaryVersion(CANARY, [older, CANARY]), null);
 });
+
+await test('npm canary lookup stays enabled for stale-publish protection', () => {
+  let invocation;
+  const version = readNpmCanaryVersion((command, args, options) => {
+    invocation = { command, args, options };
+    return `${CANARY}\n`;
+  });
+  assert.equal(version, CANARY);
+  assert.deepEqual(invocation, {
+    command: 'npm',
+    args: ['view', PACKAGE_NAME, 'dist-tags.canary'],
+    options: { encoding: 'utf8' },
+  });
+  assert.equal(readNpmCanaryVersion(() => ''), '');
+  assert.throws(() => readNpmCanaryVersion(() => '2.4.0'), /npm canary tag is malformed/);
+});