diff --git a/CHANGELOG.md b/CHANGELOG.md
index da50d6c..8520ca5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,9 +14,9 @@ full semver, because Chrome rejects pre-release suffixes such as `1.1.0-rc.1`.
 
 ## [1.0.1] — 2026-08-12
 
-No change to the extension itself. Every file under `src/` and `public/` is byte-identical
-to 1.0.0 apart from the version string, and the built `dist/` reproduces the same content
-digest 1.0.0 was built from.
+No change to the extension itself. The only difference from 1.0.0 anywhere under `src/` or
+`public/` is the version string in `public/manifest.json` — so the content digest below is
+not the one 1.0.0 would have had, and could not be: the version is part of what is hashed.
 
 What changes is that this is the first version you can check. 1.0.0 was uploaded to the
 Chrome Web Store by hand, with nothing published to compare it against. 1.0.1 is built by
diff --git a/README.md b/README.md
index 39709bb..97651f9 100644
--- a/README.md
+++ b/README.md
@@ -105,9 +105,9 @@ exact commit. The zip attached to the release is the same file that goes to the
 and you can prove it:
 
 ```bash
-gh release download v1.0.0 --repo devpeer-net/website-blocker
-sha256sum -c website-blocker-1.0.0.zip.sha256
-gh attestation verify website-blocker-1.0.0.zip --repo devpeer-net/website-blocker
+gh release download v1.0.1 --repo devpeer-net/website-blocker
+sha256sum -c website-blocker-1.0.1.zip.sha256
+gh attestation verify website-blocker-1.0.1.zip --repo devpeer-net/website-blocker
 ```
 
 The last command trusts nothing in this repository — not the release page, not the
@@ -129,7 +129,7 @@ uploaded**, before any of that rewriting. Every release publishes a content dige
 same hashes, so the two can be compared:
 
 ```bash
-node scripts/verify-install.mjs --zip website-blocker-1.0.0.zip --installed <extension-dir>
+node scripts/verify-install.mjs --zip website-blocker-1.0.1.zip --installed <extension-dir>
 ```
 
 If the digests agree, the package Google received and signed is this release, file for
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 722a6ea..6ac8593 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -14,7 +14,7 @@ pnpm release:bump 1.1.0        # package.json, manifest, and a dated CHANGELOG h
 $EDITOR CHANGELOG.md           # say what changed under the new heading
 git commit -am "Release 1.1.0"
 git tag v1.1.0
-git push --follow-tags
+git push origin main v1.1.0    # not --follow-tags: that pushes annotated tags only
 ```
 
 The tag is the trigger. Everything below happens on its own, except the one step that
diff --git a/scripts/bump-version.mjs b/scripts/bump-version.mjs
index 7d25a11..25dbd1a 100644
--- a/scripts/bump-version.mjs
+++ b/scripts/bump-version.mjs
@@ -73,5 +73,5 @@ writeFileSync(changelogPath, opened)
 console.log(`bumped to ${version}`)
 console.log('next: describe the change under the new CHANGELOG heading, then')
 console.log(
-  `  git commit -am "Release ${version}" && git tag v${version} && git push --follow-tags`,
+  `  git commit -am "Release ${version}" && git tag v${version} && git push origin HEAD v${version}`,
 )