diff --git a/lib/publish.js b/lib/publish.js
index 8ef7eff4c8a64..49b2088070e7a 100644
--- a/lib/publish.js
+++ b/lib/publish.js
@@ -35,22 +35,7 @@ const publish = async args => {
   log.verbose('publish', args)
 
   const opts = { ...npm.flatOptions }
-  const { json, defaultTag, registry } = opts
-
-  if (!registry) {
-    throw Object.assign(new Error('No registry specified.'), {
-      code: 'ENOREGISTRY',
-    })
-  }
-
-  if (!opts.dryRun) {
-    const creds = npm.config.getCredentialsByURI(registry)
-    if (!creds.token && !creds.username) {
-      throw Object.assign(new Error('This command requires you to be logged in.'), {
-        code: 'ENEEDAUTH',
-      })
-    }
-  }
+  const { json, defaultTag } = opts
 
   if (semver.validRange(defaultTag))
     throw new Error('Tag name must not be a valid SemVer range: ' + defaultTag.trim())
@@ -91,6 +76,22 @@ const publish_ = async (arg, opts) => {
   if (manifest.publishConfig)
     Object.assign(opts, publishConfigToOpts(manifest.publishConfig))
 
+  const { registry } = opts
+  if (!registry) {
+    throw Object.assign(new Error('No registry specified.'), {
+      code: 'ENOREGISTRY',
+    })
+  }
+
+  if (!dryRun) {
+    const creds = npm.config.getCredentialsByURI(registry)
+    if (!creds.token && !creds.username) {
+      throw Object.assign(new Error('This command requires you to be logged in.'), {
+        code: 'ENEEDAUTH',
+      })
+    }
+  }
+
   // only run scripts for directory type publishes
   if (spec.type === 'directory') {
     await runScript({
diff --git a/test/lib/publish.js b/test/lib/publish.js
index d4e41605df8c6..f0ce0b966533c 100644
--- a/test/lib/publish.js
+++ b/test/lib/publish.js
@@ -329,7 +329,6 @@ t.test('throw if no registry', async t => {
     '../../lib/npm.js': {
       flatOptions: {
         json: false,
-        defaultTag: '0.0.13',
         registry: null,
       },
       config,
@@ -350,7 +349,6 @@ t.test('throw if not logged in', async t => {
     '../../lib/npm.js': {
       flatOptions: {
         json: false,
-        defaultTag: '0.0.13',
         registry: 'https://registry.npmjs.org/',
       },
       config: {
@@ -369,3 +367,44 @@ t.test('throw if not logged in', async t => {
     }, 'throws when not logged in')
   })
 })
+
+t.test('read registry only from publishConfig', t => {
+  t.plan(3)
+
+  const publishConfig = { registry: 'https://some.registry' }
+  const testDir = t.testdir({
+    'package.json': JSON.stringify({
+      name: 'my-cool-pkg',
+      version: '1.0.0',
+      publishConfig,
+    }, null, 2),
+  })
+
+  const publish = requireInject('../../lib/publish.js', {
+    '../../lib/npm.js': {
+      flatOptions: {
+        json: false,
+      },
+      config,
+    },
+    '../../lib/utils/tar.js': {
+      getContents: () => ({
+        id: 'someid',
+      }),
+      logTar: () => {},
+    },
+    '../../lib/utils/output.js': () => {},
+    libnpmpublish: {
+      publish: (manifest, tarData, opts) => {
+        t.match(manifest, { name: 'my-cool-pkg', version: '1.0.0' }, 'gets manifest')
+        t.same(opts.registry, publishConfig.registry, 'publishConfig is passed through')
+      },
+    },
+  })
+
+  return publish([testDir], (er) => {
+    if (er)
+      throw er
+    t.pass('got to callback')
+  })
+})