diff --git a/ci/buildkite-secondary.yml b/ci/buildkite-secondary.yml
index 552fc36f7..8582f7e68 100644
--- a/ci/buildkite-secondary.yml
+++ b/ci/buildkite-secondary.yml
@@ -8,6 +8,7 @@ steps:
   - command: "ci/publish-crate.sh"
     timeout_in_minutes: 20
     name: "publish crate [public]"
+    branches: "!master"
   - command: "ci/publish-bpf-sdk.sh"
     timeout_in_minutes: 5
     name: "publish bpf sdk"
diff --git a/ci/publish-crate.sh b/ci/publish-crate.sh
index 960f5b5ae..35bc89ba2 100755
--- a/ci/publish-crate.sh
+++ b/ci/publish-crate.sh
@@ -1,29 +1,51 @@
 #!/usr/bin/env bash
 set -e
-
 cd "$(dirname "$0")/.."
 
-if [[ -z "$BUILDKITE_TAG" && -z "$TRIGGERED_BUILDKITE_TAG" ]]; then
-  # Skip publish if this is not a tagged release
-  exit 0
-fi
 
-if [[ -z "$CRATES_IO_TOKEN" ]]; then
-  echo CRATES_IO_TOKEN undefined
-  exit 1
-fi
+# List of internal crates to publish
+#
+# IMPORTANT: the order of the CRATES *is* significant.  Crates must be published
+# before the crates that depend on them.  Note that this information is already
+# expressed in the various Cargo.toml files, and ideally would not be duplicated
+# here. (TODO: figure the crate ordering dynamically)
+#
+CRATES=(
+  sdk
+  metrics
+  drone
+  programs/native/{budget,bpf_loader,lua_loader,native_loader,noop,system,vote}
+  .
+)
 
+
+maybePackage="echo Package skipped"
 maybePublish="echo Publish skipped"
-if [[ -n $CI ]]; then
-  maybePublish="cargo publish --token $CRATES_IO_TOKEN"
+
+# Only package/publish if this is a tagged release
+if [[ -n $BUILDKITE_TAG && -n $TRIGGERED_BUILDKITE_TAG ]]; then
+  maybePackage="cargo package"
+
+  # Only publish if there's no human around
+  if [[ -n $CI ]]; then
+    maybePublish="cargo publish --token $CRATES_IO_TOKEN"
+    if [[ -z "$CRATES_IO_TOKEN" ]]; then
+      echo CRATES_IO_TOKEN undefined
+      exit 1
+    fi
+  fi
 fi
 
-# shellcheck disable=2044 # Disable 'For loops over find output are fragile...'
-for Cargo_toml in {sdk,metrics,drone,programs/native/{budget,bpf_loader,lua_loader,native_loader,noop,system,vote},.}/Cargo.toml; do
+for crate in "${CRATES[@]}"; do
+  if [[ ! -r $crate/Cargo.toml ]]; then
+    echo "Error: $crate/Cargo.toml does not exist"
+    exit 1
+  fi
+  echo "-- $crate"
   # TODO: Ensure the published version matches the contents of BUILDKITE_TAG
   (
     set -x
-    ci/docker-run.sh rust bash -exc "cd $(dirname "$Cargo_toml"); cargo package; $maybePublish"
+    ci/docker-run.sh rust bash -exc "cd $crate; $maybePackage; $maybePublish"
   )
 done