diff --git a/examples/preact/build-dist.sh b/examples/preact/build-dist.sh
index 577a42c..b13036e 100755
--- a/examples/preact/build-dist.sh
+++ b/examples/preact/build-dist.sh
@@ -4,14 +4,37 @@
 # An allowlist rather than an .assetsignore denylist: everything that lands in
 # dist/ becomes publicly readable, so it should be a deliberate list, not
 # whatever happens to be sitting in the working directory.
+#
+# The catch with an allowlist is forgetting to add a new module, which breaks
+# the deploy outright (the import 404s and nothing loads), so the check at the
+# bottom fails the build if any top-level .js file was left out.
 set -eu
 cd "$(dirname "$0")"
 
+MODULES="index.js index-fallback.js home.js settings.js intervalometer.js
+         storage.js config-utils.js preview.js voice.js widget.js"
+# Collapse the line break to single spaces so the membership test below works.
+# shellcheck disable=SC2116,SC2086
+MODULES=$(echo $MODULES)
+
 rm -rf dist
 mkdir -p dist
 cp index.html _headers dist/
-cp index.js index-fallback.js home.js settings.js intervalometer.js \
-   storage.js config-utils.js preview.js widget.js dist/
+# shellcheck disable=SC2086
+cp $MODULES dist/
+
+missing=""
+for f in *.js; do
+  case " $MODULES " in
+    *" $f "*) ;;
+    *) missing="$missing $f" ;;
+  esac
+done
+if [ -n "$missing" ]; then
+  echo "error: top-level modules missing from the publish list:$missing" >&2
+  echo "       add them to MODULES in $0, or delete them." >&2
+  exit 1
+fi
 
 echo "dist/ contains:"
 ls -1 dist