diff --git a/release.sh b/release.sh
index f85d68c..186f6c6 100755
--- a/release.sh
+++ b/release.sh
@@ -54,6 +54,7 @@ cmd_build() {
   # BuildKit does the work (no docker on the caller). What is required is a
   # registry login for this user on this host — env token or builder config.
   local tag="${TAG:-$(date -u +%Y%m%d)-$(git rev-parse --short HEAD)}"
+  OVERLAY_LAST_TAG="$tag"   # for the `release` chain: pin THIS, not the manifest's stale tag
   [ -z "$(git status --porcelain)" ] || die "working tree is dirty — commit first, the tag carries the git sha"
 
   local logged_in=0
@@ -186,6 +187,6 @@ case "${1:-}" in
   deploy) shift; cmd_deploy "$@" ;;
   verify) shift; cmd_verify "$@" ;;
   volume) shift; cmd_volume "$@" ;;
-  release) shift; cmd_build "$@"; t=$(manifest_tag); cmd_deploy ;;
+  release) shift; cmd_build "$@"; cmd_pin "$OVERLAY_LAST_TAG"; cmd_deploy; cmd_verify ;;
   *) sed -n '2,30p' "$0" | sed 's/^# \{0,1\}//' ; exit 1 ;;
 esac