diff --git a/.github/workflows/publish_pypi.yml b/.github/workflows/publish_pypi.yml
index 05706b6..fcf6f3b 100644
--- a/.github/workflows/publish_pypi.yml
+++ b/.github/workflows/publish_pypi.yml
@@ -37,12 +37,31 @@ jobs:
         run: |
           # the stock clang on noble (18) is too old for the 2025+ MSVC STL that
           # cargo-xwin downloads (yvals_core.h: "error STL1000: expected Clang
-          # 19.0.0 or newer"), so take the newest clang / lld / libclang / llvm
-          # tools from apt.llvm.org (generic package names, nothing pinned)
+          # 19.0.0 or newer"), so take a newer clang toolchain from apt.llvm.org.
+          # apt.llvm.org sometimes half-publishes a new version, in which case the
+          # unversioned meta packages become uninstallable ("clang: Depends:
+          # clang-NN ... not installable"); so pick the newest versioned set that
+          # actually resolves (a dry-run checks the whole dependency closure) -
+          # nothing is hardcoded, this tracks the newest working release.
           sudo apt update
           echo "deb [trusted=yes] https://apt.llvm.org/noble/ llvm-toolchain-noble main" | sudo tee /etc/apt/sources.list.d/llvm-toolchain-noble.list >/dev/null
           sudo apt update
-          sudo apt install -y build-essential cmake clang lld libclang-dev llvm
+          sudo apt install -y build-essential cmake
+          NEWEST=""
+          for v in $(apt-cache search '^clang-[0-9]+$' | awk '{print $2}' | sort -rn); do
+            if sudo apt-get install --dry-run -y "clang-$v" "llvm-$v" "lld-$v" "libclang-$v-dev" >/dev/null 2>&1; then
+              NEWEST=$v
+              break
+            fi
+          done
+          [ -n "$NEWEST" ] || { echo "no installable clang toolchain found in apt.llvm.org" >&2; exit 1; }
+          echo "using clang/llvm toolchain $NEWEST"
+          sudo apt install -y "clang-$NEWEST" "llvm-$NEWEST" "lld-$NEWEST" "libclang-$NEWEST-dev"
+          # expose the toolchain's own bin/lib dirs (clang, clang-cl, lld-link,
+          # llvm-lib, libclang) to the later steps
+          echo "LLVM_BIN=/usr/lib/llvm-$NEWEST/bin" >> "$GITHUB_ENV"
+          echo "LIBCLANG_PATH=/usr/lib/llvm-$NEWEST/lib" >> "$GITHUB_ENV"
+          export PATH="/usr/lib/llvm-$NEWEST/bin:$PATH"
           clang --version | head -1
           command -v clang clang-cl lld-link llvm-lib
         shell: bash
@@ -133,12 +152,11 @@ jobs:
         shell: bash
         run: |
           export PATH="$HOME/.osxcross/bin:$PATH"
-          # the shim (for ring's forced plain `clang`) goes in front of the
-          # llvm tools so clang-cl / lld-link (distinct names) still resolve to
-          # the real toolchain; bindgen finds libclang via LIBCLANG_PATH
-          LLVM_BIN=$(dirname "$(readlink -f "$(command -v clang)")")
+          # LLVM_BIN and LIBCLANG_PATH were set by the "Install build
+          # dependencies" step; put the shim (for ring's forced plain `clang`)
+          # in front of the toolchain so clang-cl / lld-link (distinct names)
+          # still resolve to the real toolchain
           export PATH="/root/ci-shims:$LLVM_BIN:$PATH"
-          export LIBCLANG_PATH="$(dirname "$LLVM_BIN")/lib"
           rm -rf dist
           maturin sdist --out dist -m ndbioimage/Cargo.toml