diff --git a/.github/actions/npm-build/action.yml b/.github/actions/npm-build/action.yml
new file mode 100644
index 000000000..8568ad548
--- /dev/null
+++ b/.github/actions/npm-build/action.yml
@@ -0,0 +1,53 @@
+name: Build npm package
+description: Install Node, build, and optionally test the npm package
+
+inputs:
+  working-directory:
+    description: Path to the npm package directory
+    default: "./pkgs/npm"
+  node-version:
+    description: Node.js version to install
+    default: "24" # same as the version in flake.nix
+  registry-url:
+    description: npm registry URL (set when publishing)
+    default: ""
+  version:
+    description: Package version to set (e.g. from a git tag). Skipped if empty.
+    default: ""
+  run-tests:
+    description: Whether to run tests after building
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Install node
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+      with:
+        node-version: ${{ inputs.node-version }}
+        registry-url: ${{ inputs.registry-url }}
+
+    - name: Set package version
+      if: inputs.version != ''
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        INPUT_VERSION: ${{ inputs.version }}
+      run: |
+        VERSION="${INPUT_VERSION#v}"
+        npm version "$VERSION" --no-git-tag-version
+    - name: Install dependencies
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: npm ci --ignore-scripts
+
+    - name: Build
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: npm run build
+
+    - name: Test
+      if: inputs.run-tests == 'true'
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: npm test
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index db556e88e..ce376456f 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -487,29 +487,11 @@ jobs:
       - name: Checkout tag
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Install node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+      - name: Build npm package
+        uses: ./.github/actions/npm-build
         with:
-          node-version: "24" # same as the version in flake.nix
           registry-url: https://registry.npmjs.org
-
-      - name: Build npm package
-        shell: bash
-        working-directory: ./pkgs/npm
-        run: |
-          # Get version number without the 'v'
-          version_number=$(echo "${{ github.ref_name }}" | cut -c2-)
-          export version_number
-
-          echo "Setting version number to ${version_number}"
-          # update version placeholder in package.json with version matching binary.
-          npm version "${version_number}" --no-git-tag-version
-
-          # install dependencies
-          npm ci --ignore-scripts
-
-          # build
-          npm run build
+          version: ${{ github.ref_name }}
 
       - run: npm publish --access public
         shell: bash
diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml
index e7ec467cf..d3ed550f0 100644
--- a/.github/workflows/npm.yml
+++ b/.github/workflows/npm.yml
@@ -6,6 +6,7 @@ on:
       - "**"
     paths:
       - ".github/workflows/npm.yml"
+      - ".github/actions/npm-build/**"
       - "pkgs/npm/**"
 
 permissions:
@@ -17,14 +18,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Install node
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
-        with:
-          node-version: "24" # same as the version in flake.nix
-
       - name: Build and test npm package
-        working-directory: ./pkgs/npm
-        run: |
-          npm ci --ignore-scripts
-          npm run build
-          npm test
+        uses: ./.github/actions/npm-build
+        with:
+          run-tests: "true"
diff --git a/flake.nix b/flake.nix
index 214329cd9..41cae5055 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,7 +29,7 @@
               golangci-lint
               goreleaser
               nixfmt-rfc-style
-              nodejs_24 # for Pulumi, must match values in package.json
+              nodejs_24 # for Pulumi, must match values in package.json and npm-build/action.yml
               openssh
               protobuf # protoc
               protoc-gen-connect-go