diff --git a/tools/release.ts b/tools/release.ts
index 162654c..2e82dbf 100644
--- a/tools/release.ts
+++ b/tools/release.ts
@@ -275,6 +275,8 @@ async function main(): Promise<void> {
   push ${branch}, push ${tag}; then in parallel: Mac build + notarize -> ${out.replace(HOME, '~')}; macOS acceptance (${accCached ? 'cached' : 'runs now'}, key ${key.slice(0, 12)});
   Forgejo ci (candidate of the bump commit) + release.yml (promotion); add, verify, publish to ${rehearsal ? 'the rehearsal channel' : 'stable'} via ${host};
   ${rehearsal ? 'app copied to a scratch folder; then the tag, release, candidates, branch and storebound.dev files of the rehearsal are deleted' : 'update /Applications/storebound.app; print npm publish + npm deprecate'}`);
+  // the dry run catches what the bump would refuse
+  if (!rehearsal && !resume) { try { cutChangelog(readFileSync(join(ROOT, 'CHANGELOG.md'), 'utf8'), version, '2000-01-01'); } catch (e) { fail((e as Error).message); } }
   if (!yes) { console.log('\ndry run: nothing changed (--yes to release)'); return; }
 
   const accP = TESTS ? phase('macOS acceptance (cache or 3 runs)', () => macAcceptance(key, logDir)) : Promise.resolve('');
@@ -285,8 +287,10 @@ async function main(): Promise<void> {
   let sha = resume ? head : '';
   if (!resume) await phase('bump + fast gate + commit + push', async () => {
     if (rehearsal) sh(['git', 'checkout', '-q', '-b', branch]);
+    // the CHANGELOG cut is checked before any file changes (an empty Unreleased once left every version copy bumped)
+    const cut = rehearsal ? null : cutChangelog(readFileSync(join(ROOT, 'CHANGELOG.md'), 'utf8'), version, new Date().toISOString().slice(0, 10));
     setVersion(version);
-    if (!rehearsal) writeFileSync(join(ROOT, 'CHANGELOG.md'), cutChangelog(readFileSync(join(ROOT, 'CHANGELOG.md'), 'utf8'), version, new Date().toISOString().slice(0, 10)));
+    if (cut) writeFileSync(join(ROOT, 'CHANGELOG.md'), cut);
     const code = TESTS ? await bg('ci:quick', ['bun', 'run', 'ci:quick'], join(logDir, 'ci-quick.log'), { timeoutMs: 15 * 60_000 }) : 0;
     if (code !== 0) {
       // nothing was committed or pushed: put the checkout back as it was