diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1b92781..56f5b45 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -26,8 +26,5 @@ jobs:
     - name: Publish to PyPI
       env:
         UV_PUBLISH_TOKEN: ${{ secrets.TANGO_PYPI_TOKEN }}
-      # --check-url makes the upload idempotent: uv queries the index first and skips
-      # files already present instead of failing the run. Without it, any version that
-      # reached PyPI by another route — a manual `uv publish`, a re-run of this
-      # workflow — makes the GitHub Release that follows it go red for no real reason.
+      # --check-url skips files already on the index, so re-running this is a no-op rather than an error.
       run: uv publish --check-url https://pypi.org/simple/
diff --git a/pyproject.toml b/pyproject.toml
index ee9e263..91211bb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -126,13 +126,14 @@ packages = ["tango"]
 # diaries, scratch reports, etc.) when anyone runs `uv publish` locally.
 # The explicit whitelist is belt-and-suspenders for that foot-gun: even
 # from a developer laptop, only these paths can ever end up on PyPI.
+#
+# `.github/workflows` is excluded on purpose: shipping it moves the sdist hash on every CI-only commit, which breaks `--check-url`.
 [tool.hatch.build.targets.sdist]
 include = [
     "/tango",
     "/tests",
     "/docs",
     "/scripts",
-    "/.github/workflows",
     "/README.md",
     "/LICENSE",
     "/CHANGELOG.md",