diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index af3c46c..5fa1296 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -119,6 +119,13 @@ jobs:
           DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
         run: |
           set -euo pipefail
+          # infra#311: fail on an empty tag BEFORE patching anything. The
+          # grep verification further down CANNOT catch it -- with IMAGE_TAG
+          # empty its pattern matches the very corruption it exists to reject.
+          # The result is `image: <repo>:` in the manifest, which is invalid
+          # YAML, so Flux fails the ENTIRE apps Kustomization and every app
+          # stops reconciling, not just this one. That happened on 2026-08-25.
+          [ -n "${IMAGE_TAG:-}" ] || { echo "IMAGE_TAG is empty - refusing to patch"; exit 1; }
 
           # INFRA_DEPLOY_KEY is a Gitea org secret (mathias org), already
           # configured per docs/cd-pipeline.md in the infra repo — same key