diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index c14f1dd..a57eece 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -164,7 +164,17 @@ jobs:
           api="$SERVER_URL/api/v1/repos/$REPO_PATH/releases"
           auth=(-H "Authorization: token $GITEA_TOKEN")
 
-          prev_tag=$(git tag --sort=-v:refname | grep -A1 -x -F "$TAG" | tail -n1)
+          # Fail here rather than on an opaque 401 four curls later.
+          [ -n "${GITEA_TOKEN:-}" ] || { echo "the BUILD_TOKEN secret is empty" >&2; exit 1; }
+
+          # The tag before $TAG, for the compare link. $TAG is injected into the list
+          # before sorting because it need not be a tag that exists: a
+          # workflow_dispatch run publishes a release for a tag nobody has pushed,
+          # and Gitea creates it. Without the injection grep matches nothing, and
+          # under `set -e -o pipefail` that took the whole step down before the first
+          # echo. `sort -uV` also puts v2.9 before v2.10, which -v:refname alone on a
+          # list missing $TAG cannot help with.
+          prev_tag=$( { git tag; echo "$TAG"; } | sort -uV | grep -B1 -x -F "$TAG" | head -n1 )
           if [ "$prev_tag" = "$TAG" ]; then prev_tag=""; fi
           if [ -n "$prev_tag" ]; then
             body="**Full Changelog**: $SERVER_URL/$REPO_PATH/compare/$prev_tag...$TAG"