diff --git a/build b/build
index 83a980c..1875b8d 100755
--- a/build
+++ b/build
@@ -130,15 +130,18 @@ if [ "$RELEASE_CHANNEL" = "stable" ]; then
         echo "=== Seeding $RELEASES_DIR from $LIVE_RELEASES (per-version artifacts only) ==="
         rm -rf "$RELEASES_DIR"
         mkdir -p "$RELEASES_DIR"
-        # Copy per-version immutable files + their .sig sidecars. The
-        # canonical <tool>.html / zddc-server_<plat> symlinks will be
-        # rewritten by this cut and old channel/partial-pin files from
-        # the previous layout (if any still live there) will be cleaned
-        # up by deploy's --delete-after rsync.
-        find "$LIVE_RELEASES" -maxdepth 1 -type f \( \
-            -name '*_v*.html' -o \
-            -name '*_v*.html.sig' -o \
-            -name 'zddc-server_v*' \
+        # Copy per-version immutable files + their .sig sidecars only.
+        # Strict X.Y.Z match avoids picking up legacy partial-version
+        # pins (_v<X.Y>, _v<X>) that may still be lying around as
+        # leftover .sig files in /srv/zddc/releases/ from the pre-
+        # simplification layout. The canonical <tool>.html /
+        # zddc-server_<plat> symlinks will be rewritten by this cut;
+        # anything else (channel mirrors, partial pins, retired tools)
+        # gets cleaned by deploy's --delete-after rsync.
+        find "$LIVE_RELEASES" -maxdepth 1 -type f -regextype posix-extended \( \
+            -regex '.*/[a-z-]+_v[0-9]+\.[0-9]+\.[0-9]+\.html' -o \
+            -regex '.*/[a-z-]+_v[0-9]+\.[0-9]+\.[0-9]+\.html\.sig' -o \
+            -regex '.*/zddc-server_v[0-9]+\.[0-9]+\.[0-9]+_.*' \
         \) -exec cp -a '{}' "$RELEASES_DIR/" \;
         # Also seed the public key (it lives at the releases root).
         if [ -f "$LIVE_RELEASES/pubkey.pem" ]; then