diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index 9d15e2611548..c7c0cd3f7413 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -579,6 +579,15 @@ jobs:
     name: Build Determinism
     runs-on: ubuntu-latest
     needs: [build-ic, bazel-test-all]
+    # Run even when `bazel-test-all` fails: its test failures happen *after*
+    # its build succeeded, its execution logs were uploaded (the bazel action
+    # uploads them on failure too) and — on release builds — the artifacts
+    # were already published to the CDN. Without this condition a single
+    # failing/flaky test silently skipped the determinism check while the
+    # artifacts still shipped. `build-ic` still has to succeed: it produces the
+    # no-cache side of the comparison (and is skipped on merge_group, where
+    # there is nothing to compare).
+    if: ${{ !cancelled() && needs.build-ic.result == 'success' }}
     steps:
       - name: Download execution logs (cache)
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1