diff --git a/.github/workflows/promote.yaml b/.github/workflows/promote.yaml
index 99ffd5e..76a4352 100644
--- a/.github/workflows/promote.yaml
+++ b/.github/workflows/promote.yaml
@@ -20,6 +20,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-node@v4
         with:
@@ -37,10 +39,9 @@ jobs:
       - name: Promote to latest
         run: |
           if ! npm dist-tag add @currents/mcp@${{ github.event.inputs.packageVersion }} latest; then
-            echo "::error::The registry refused the dist-tag. Trusted publishing grants it separately from publish, and it is off by default: enable 'Allow npm dist-tag' on the trusted publisher configuration for @currents/mcp at https://www.npmjs.com/package/@currents/mcp/access"
+            echo "::error::The registry refused the dist-tag. Trusted publishing configurations are keyed on the workflow filename and each grants dist-tag separately, so @currents/mcp needs a configuration naming THIS file with 'Allow npm dist-tag' enabled on it — the one for publish.yaml does not carry over. https://www.npmjs.com/package/@currents/mcp/access"
             exit 1
           fi
-          npm dist-tag rm @currents/mcp beta
 
   # Separate job so the third-party actions below do not run beside
   # `id-token: write`: neither needs OIDC, and both resolve a mutable tag.
@@ -51,6 +52,13 @@ jobs:
       contents: read
 
     steps:
+      # linear-release refuses to start outside a git repository, whichever
+      # command it is given. fetch-depth as its quick start documents.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
       - name: Mark Linear release as complete
         id: release
         uses: linear/linear-release-action@v0
diff --git a/RELEASE.md b/RELEASE.md
index 91ee3a1..634bcc9 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -104,15 +104,23 @@ To promote a beta release to the `latest` tag without re-publishing:
 The workflow will:
 
 1. Add the `latest` dist-tag to the specified version
-2. Remove the `beta` dist-tag from that version
-3. Mark the release complete in Linear and post it to Slack
+2. Mark the release complete in Linear and post it to Slack
+
+`beta` is left pointing at the promoted version. The next publish to that
+channel moves it, so between releases `beta` and `latest` name the same
+version. Re-running the workflow on a version already promoted is therefore
+harmless.
 
 This is useful when you've tested a beta release and want to make it the default install without rebuilding.
 
 The workflow authenticates with npm through Trusted Publishing, so it needs no
-`NPM_TOKEN`. Trusted publishing grants dist-tag separately from publish, and the
-grant is off by default: **Allow npm dist-tag** has to be enabled on the trusted
-publisher configuration for `@currents/mcp`, or the registry refuses the tag.
+`NPM_TOKEN`. A trusted publisher configuration names one workflow file, so
+`@currents/mcp` carries one per workflow that reaches npm — `publish.yaml` and
+`promote.yaml` each have their own, and neither authorizes the other. Each
+grants dist-tag separately from publishing, off by default, so a configuration
+that promotes needs **Allow npm dist-tag** enabled on it or the registry
+refuses the tag. Both are managed per package at
+https://www.npmjs.com/package/@currents/mcp/access.
 
 ## Linear Release