diff --git a/.github/workflows/ns8-module.yml b/.github/workflows/ns8-module.yml
index b53baf7e..76ef09f1 100644
--- a/.github/workflows/ns8-module.yml
+++ b/.github/workflows/ns8-module.yml
@@ -37,6 +37,16 @@ jobs:
           bash -n imageroot/actions/configure-module/80start_services
           bash -n build-images.sh
           bash -n push-manifest.sh
+          # Every buildah subcommand the scripts invoke must be a real one.
+          # A typo like "buildah image exists" (there is no singular form)
+          # only surfaces after a full two-arch build, minutes into a publish.
+          # This runner has buildah preinstalled, so check it here instead.
+          for sub in $(grep -ohE 'buildah [a-z]+' build-images.sh push-manifest.sh | awk '{print $2}' | sort -u); do
+            if ! buildah "$sub" --help >/dev/null 2>&1; then
+              echo "::error::buildah has no subcommand '$sub' used by the build scripts"
+              exit 1
+            fi
+          done
           # No build-time placeholders may remain: the unit and configure read
           # the app ref from ${CALNODE_IMAGE} at install time.
           ! grep -rn '__CALNODE_APP_IMAGE__' imageroot/
diff --git a/packaging/ns8/push-manifest.sh b/packaging/ns8/push-manifest.sh
index ea126793..f879ca14 100755
--- a/packaging/ns8/push-manifest.sh
+++ b/packaging/ns8/push-manifest.sh
@@ -36,7 +36,9 @@ if [ "${#arches[@]}" -eq 0 ]; then
 fi
 
 for arch in "${arches[@]}"; do
-    if ! buildah image exists "${repobase}/${reponame}:build-${arch}"; then
+    # `images -q` prints the image ID when the tag is present and prints
+    # nothing when it is absent. There is no singular "image exists" form.
+    if [ -z "$(buildah images -q "${repobase}/${reponame}:build-${arch}")" ]; then
         echo "Missing local image for ${arch}. Run build-images.sh with" \
              "TARGETARCH=${arch} PUSH=1 first." >&2
         exit 1