diff --git a/tools/release.ts b/tools/release.ts
index 16e3ec7..3caac77 100644
--- a/tools/release.ts
+++ b/tools/release.ts
@@ -395,6 +395,13 @@ async function main(): Promise<void> {
 
   // ---------------------------------------------------------------- 6. publish
   await phase('publish (VDS seeds from Forgejo, Mac files once, latest.json)', async () => {
+    // a resume after a publish that went out (only its check failed, e.g. the site was down) must not publish again:
+    // signatures are not byte-identical on a second run and the server never replaces a published file
+    if (!rehearsal && resume) {
+      const live = await fetch(`https://storebound.dev/desktop/latest.json?t=${Date.now()}`, { signal: AbortSignal.timeout(20_000) })
+        .then(r => (r.ok ? r.json() as Promise<{ version?: string }> : null)).catch(() => null);
+      if (live?.version === version) { say(`desktop ${version} is already live on the stable channel: publish skipped`); return; }
+    }
     const code = await bg('publish', ['bun', 'tools/desktop-release.ts', 'publish', '--out', out, '--host', host, '--channel', rehearsal ? 'rehearsal' : 'stable', '--forgejo-tag', tag, '--yes'], join(logDir, 'publish.log'), { timeoutMs: 45 * 60_000 });
     if (code !== 0) fail(`publish failed: ${join(logDir, 'publish.log').replace(HOME, '~')}`);
   });