diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6680c60..a3cb180 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -33,14 +33,13 @@ updates:
 
   # GitHub Actions pinned in the CI / release / npm-publish / mirror workflows.
   #
-  # REVIEWER TRAP: `.github/workflows/release.yml` is GENERATED by cargo-dist and
-  # is verified against the generator by the `plan` job. Dependabot cannot be
-  # told to skip a single file, so it will keep proposing action bumps inside
-  # that file — and `plan` will keep failing them. Do NOT merge such a PR: `plan`
-  # is also the FIRST job of the real release workflow, so a mismatched
-  # release.yml breaks the next `vX.Y.Z` tag push, not just the PR. Drop the
-  # release.yml hunks and keep the rest; the file only changes when
-  # `cargo-dist-version` is bumped and `dist generate` is re-run.
+  # NOTE: bumps here also rewrite action pins inside
+  # `.github/workflows/release.yml`, which is GENERATED by cargo-dist. That used
+  # to fail the `plan` job (and, because `plan` is the first job of the real
+  # release workflow, broke tag releases — twice: PR #1, then PR #11). Cargo.toml
+  # now sets `allow-dirty = ["ci"]`, so dist no longer verifies that file and
+  # these PRs are safe to merge. The tradeoff is written up next to that key: if
+  # you change the dist config, re-run `dist generate` yourself.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
diff --git a/CLAUDE.md b/CLAUDE.md
index 4a3dcfb..6e8f25c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -155,6 +155,15 @@ Releases are tag-driven: pushing a `vX.Y.Z` tag runs `release.yml` (cargo-dist
 builds the target triples + a GitHub Release with shell/powershell/npm/homebrew
 installers), then `mirror-to-s3.yml` mirrors to `download.bugsee.com/cli/<ver>/`.
 
+`release.yml` is GENERATED by cargo-dist from `[workspace.metadata.dist]` — do
+not hand-edit it for anything except the action pins dependabot manages. That
+config sets `allow-dirty = ["ci"]`, so `dist plan` no longer verifies the file
+against the generator (dependabot's action bumps kept breaking that check, and
+with it tag releases). The cost is that dist-config changes no longer propagate
+on their own: after editing `targets`, `installers`, `publish-jobs`, or
+`cargo-dist-version`, run `dist generate` and commit the regenerated workflow in
+the SAME change, or the release will still run the old plan.
+
 New capabilities are activated by integrators via a version FLOOR: each integrator
 pins a minimum CLI version and only uses a new command/flag when the resolved
 binary meets it. So shipping a feature is a two-step rollout — publish the CLI at
diff --git a/Cargo.toml b/Cargo.toml
index d59ab28..9bb2900 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,6 +36,21 @@ lto = "thin"
 [workspace.metadata.dist]
 # The preferred dist version to use in CI (Cargo.toml SemVer syntax)
 cargo-dist-version = "0.32.0"
+# Stop `dist plan` from verifying `.github/workflows/release.yml` byte-for-byte
+# against the generator.
+#
+# WHY: dependabot bumps action pins across ALL workflows and cannot be told to
+# skip one file, so it keeps rewriting `actions/checkout@vN` inside the
+# dist-GENERATED release.yml. `plan` is the first job of the release workflow,
+# so merging such a PR breaks the next `vX.Y.Z` tag push — that happened twice
+# (PR #1, then PR #11). No published cargo-dist emits a newer checkout pin, so
+# there is no version to upgrade into; the mismatch is unavoidable.
+#
+# COST: release.yml is no longer auto-verified, so a change to the dist config
+# BELOW (targets, installers, publish-jobs, ...) will NOT be reflected in the
+# workflow and nothing will warn you. After editing any of it, re-run
+# `dist generate` and commit the result in the same change.
+allow-dirty = ["ci"]
 # CI backends to support
 ci = "github"
 # The installers to generate for each app