diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 5f50e6a..bf204b2 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -33,10 +33,29 @@ jobs:
           set -euo pipefail
           echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
-          # Annotated tag message becomes the changelog; build.yaml is the fallback.
+          # checkout leaves behind a lightweight ref pointing at the commit, and
+          # %(contents) on one of those yields the commit message. Re-fetch the
+          # real object so an annotated tag's message is what we read.
+          git fetch --force origin \
+            "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}" || true
+
+          CHANGELOG=""
+          if [ "$(git cat-file -t "refs/tags/${GITHUB_REF_NAME}" 2>/dev/null || true)" = "tag" ]; then
+            # subject+body rather than %(contents) so a signature is left out.
+            CHANGELOG="$(git for-each-ref \
+              --format='%(contents:subject)%0a%0a%(contents:body)' \
+              "refs/tags/${GITHUB_REF_NAME}")"
+          fi
+
+          # Lightweight tag, or an annotated tag with an empty message.
+          if [ -z "$(printf '%s' "$CHANGELOG" | tr -d '[:space:]')" ]; then
+            echo "no annotated tag message; falling back to build.yaml"
+            CHANGELOG="$(python -c "import yaml; print(yaml.safe_load(open('build.yaml')).get('changelog','').strip())")"
+          fi
+
           {
             echo "changelog<<CHANGELOG_EOF"
-            git tag -l --format='%(contents)' "$GITHUB_REF_NAME"
+            printf '%s\n' "$CHANGELOG"
             echo "CHANGELOG_EOF"
           } >> "$GITHUB_OUTPUT"