diff --git a/shared/build-lib.sh b/shared/build-lib.sh
index eee362e..26259c3 100755
--- a/shared/build-lib.sh
+++ b/shared/build-lib.sh
@@ -314,13 +314,18 @@ promote_release() {
                 echo "promote_release: stable channel but no build_version" >&2
                 return 1
             fi
-            _latest=$(git -C "$root_dir" tag --list "${_tool}-v*" 2>/dev/null \
-                      | grep -E "^${_tool}-v[0-9]+\.[0-9]+\.[0-9]+\$" \
-                      | sort -V | tail -1)
-            if [ -n "$_latest" ] && git -C "$root_dir" diff --quiet "$_latest" HEAD -- . ../shared 2>/dev/null; then
-                echo "${_tool}: no source changes since $_latest — skipping"
-                return 0
-            fi
+            # Lockstep: every release cut writes per-version files for
+            # every tool, even when a tool's source hasn't changed since
+            # its last tag. The bytes are identical (build is deterministic
+            # at the same source), so the overwrite is a no-op on disk;
+            # but the symlink chain (_v<X.Y>, _v<X>, _stable, _beta, _alpha)
+            # gets advanced to the new version, which is the actual goal.
+            #
+            # The previous "skip if no source changes since $_latest" check
+            # was a relic of per-tool independent versioning. It broke
+            # CI re-cuts at a tag commit (HEAD == latest tag → diff empty
+            # → skip → dist/release-output/ stays seeded at the previous
+            # version → deploy publishes the previous version).
             _promote_stable "$_tool" "$build_version" "$_releases_dir"
             ;;
         alpha | beta)