diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 5817349..2e12f90 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -76,13 +76,18 @@ jobs:
       # lockfile from the root context; building from apps/api/ would fail to find them.
       - name: Build and push
         run: |
+          set -euo pipefail
           docker build --target production \
             -f apps/api/Dockerfile \
             -t ${{ steps.tags.outputs.latest }} \
             -t ${{ steps.tags.outputs.sha_tag }} \
             .
-          docker push ${{ steps.tags.outputs.latest }}
-          docker push ${{ steps.tags.outputs.sha_tag }}
+          # Push the IMMUTABLE :<milestone>-<sha> tag FIRST. set -euo pipefail stops on
+          # the first failed push, so :latest is only moved after the immutable,
+          # rollback-traceable tag has landed — a failed second push can never leave
+          # :latest advanced without a corresponding rollback tag (WR-04).
+          docker push ${{ steps.tags.outputs.sha_tag }}   # immutable first
+          docker push ${{ steps.tags.outputs.latest }}    # move pointer only after immutable lands
 
       # Always drop the stored credential from the runner after push (defence in depth).
       - name: Docker logout