move the ensure-setup check to the add stage to make sure it always runs, h/t @soldair