diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 2db6a40..cd5aedf 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -60,10 +60,17 @@ jobs:
             echo "version-tag=${REF#refs/tags/}" >> "$GITHUB_OUTPUT"
             echo "version=${REF#refs/tags/}" >> "$GITHUB_OUTPUT"
           else
-            # The ldflags version stamp: git tag on a v* build, else short sha.
-            # Computed here in shell, not as a `${{ a || b }}` expression, so it
-            # cannot depend on how the runner treats an empty step output -- a
-            # wrong VERSION would be baked into the binary silently.
+            # The ldflags version stamp: git tag on a v* build, else short
+            # sha. Computed in shell rather than as a fallback expression in
+            # YAML, so it cannot depend on how the runner treats an empty step
+            # output -- a wrong VERSION would be baked into the binary silently.
+            #
+            # NOTE: no expression syntax in this comment, deliberately. act
+            # interpolates a run: block INCLUDING its comments, so prose
+            # containing that syntax is evaluated as an expression -- it failed
+            # with "Unavailable context: a", the step wrote no outputs, and the
+            # deploy job committed an empty image tag that broke Flux
+            # estate-wide (infra 51ceb7c).
             echo "version=${SHA}" >> "$GITHUB_OUTPUT"
           fi