diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 81a1f94..17d4292 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -279,33 +279,43 @@ jobs:
           ls -l dist && echo "----" && cat dist/SHA256SUMS
 
       # ── RELEASE ENGINE: commit the bump, tag, push ───────────────────────
-      - name: Commit version bump and push tag
+      # Tag only — `main` is never pushed to.
+      #
+      # This step used to commit the version bump back to main first. Two things
+      # were wrong with that. It has never once executed: an EMPTY template
+      # expression written literally in a comment (the `$`+`{{ }}` token, which
+      # is why it is spelled out here) made the runner fail to build the script
+      # and skip the whole step silently, which is why sidecar/Cargo.toml still
+      # says 0.1.0 after six releases (the tags exist because the release API
+      # creates one when it publishes). And had it executed, it would have been
+      # declined — main is protected, and a release must not depend on a write
+      # to a protected branch.
+      #
+      # So the tag is the version, as it already is in servuo-plugins. The
+      # workflow still writes the real version into Cargo.toml before building,
+      # so a released binary self-reports correctly; what it no longer does is
+      # commit that edit back. The next version is computed from the newest tag,
+      # never from Cargo.toml, so nothing downstream depends on the file.
+      - name: Push the release tag
         if: ${{ steps.plan.outputs.release == 'true' }}
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           set -euo pipefail
-          VERSION="${{ steps.plan.outputs.version }}"
           TAG="${{ steps.plan.outputs.tag }}"
           # Secrets can arrive with a trailing newline (depending on how they were
           # pasted); a stray CR/LF corrupts the remote URL ("credential url cannot
-          # be parsed"). Strip line breaks before building the URL. Passing them via
-          # env (not inline ${{ }}) also keeps a newline from breaking this script.
+          # be parsed"). Strip line breaks before building the URL. They are passed
+          # via env rather than interpolated into this script, so a newline cannot
+          # break it — do NOT write a template token literally in a comment here,
+          # or the runner will skip this step without failing the job.
           CI_USER="$(printf '%s' "${REGISTRY_USER}" | tr -d '\r\n')"
           CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"
           git config user.name  "uo-link-ci"
           git config user.email "ci@whitlocktech.com"
           git remote set-url origin \
             "https://${CI_USER}:${CI_TOKEN}@${GITEA_HOST}/${REPO}.git"
-
-          git add "${WORKDIR}/Cargo.toml" "${WORKDIR}/Cargo.lock"
-          if ! git diff --cached --quiet; then
-            git commit -m "chore(release): bump version to ${TAG} [skip ci]"
-            git push origin "HEAD:main"
-          else
-            echo "Version unchanged (first release) — no bump commit needed."
-          fi
           # The tag may already exist when finishing a run that died after tagging
           # (see the plan step). `git tag` on an existing name fails under
           # `set -e`; pushing an identical existing tag is a harmless no-op. A