diff --git a/.github/actions/release-binaries/action.yml b/.github/actions/release-binaries/action.yml
index c69481a88..d75335ccd 100644
--- a/.github/actions/release-binaries/action.yml
+++ b/.github/actions/release-binaries/action.yml
@@ -12,7 +12,11 @@ inputs:
     description: 'Which project to build: "vikunja" or "veans".'
     required: true
   release-version:
-    description: 'Raw git describe value (e.g. v1.2.3 or a sha). Use "" or "main" for unstable builds.'
+    description: |
+      Raw git describe value (e.g. v1.2.3 or v2.3.0-408-ge053d317). Always
+      passed through to the build so the binary embeds the precise commit.
+      Filenames and the S3 directory use "unstable" instead whenever
+      github.ref_type isn't "tag".
     required: true
   # Secrets — composite actions can't read the `secrets` context directly, so
   # the caller threads them through as inputs.
@@ -39,6 +43,7 @@ runs:
       env:
         PROJECT: ${{ inputs.project }}
         RELEASE_VERSION_INPUT: ${{ inputs.release-version }}
+        VERSION_OR_UNSTABLE: ${{ github.ref_type == 'tag' && inputs.release-version || 'unstable' }}
       run: |
         set -euo pipefail
 
@@ -50,13 +55,6 @@ runs:
             ;;
         esac
 
-        # version-or-unstable: real version unless empty/"main", in which case "unstable".
-        if [ -z "$RELEASE_VERSION_INPUT" ] || [ "$RELEASE_VERSION_INPUT" = "main" ]; then
-          version_or_unstable="unstable"
-        else
-          version_or_unstable="$RELEASE_VERSION_INPUT"
-        fi
-
         case "$PROJECT" in
           vikunja)
             output_dir="."
@@ -71,11 +69,11 @@ runs:
         {
           echo "PROJECT=$PROJECT"
           echo "RELEASE_VERSION=$RELEASE_VERSION_INPUT"
-          echo "VERSION_OR_UNSTABLE=$version_or_unstable"
-          echo "XGO_OUT_NAME=${PROJECT}-${version_or_unstable}"
+          echo "VERSION_OR_UNSTABLE=$VERSION_OR_UNSTABLE"
+          echo "XGO_OUT_NAME=${PROJECT}-${VERSION_OR_UNSTABLE}"
           echo "OUTPUT_DIR=$output_dir"
           echo "DIST_PREFIX=$dist_prefix"
-          echo "S3_TARGET_PATH=/${PROJECT}/${version_or_unstable}"
+          echo "S3_TARGET_PATH=/${PROJECT}/${VERSION_OR_UNSTABLE}"
           echo "ARTIFACT_BINARIES_NAME=${PROJECT}_bins"
           echo "ARTIFACT_ZIPS_NAME=${PROJECT}_bin_packages"
         } >> "$GITHUB_ENV"
diff --git a/.github/actions/release-os-package/action.yml b/.github/actions/release-os-package/action.yml
index bfa44c64a..bd205f211 100644
--- a/.github/actions/release-os-package/action.yml
+++ b/.github/actions/release-os-package/action.yml
@@ -12,7 +12,11 @@ inputs:
     description: 'Project name (vikunja | veans). Drives all derived paths.'
     required: true
   release-version:
-    description: 'RELEASE_VERSION env value — the same version that ended up in the binaries artifact. Empty or "main" maps to "unstable".'
+    description: |
+      RELEASE_VERSION env value — the same version that ended up in the
+      binaries artifact. Always embedded in the package metadata via
+      nfpm; filenames and the S3 directory use "unstable" instead
+      whenever github.ref_type isn't "tag".
     required: true
   packager:
     description: 'nfpm packager: rpm | deb | apk | archlinux.'
@@ -51,6 +55,7 @@ runs:
       env:
         PROJECT: ${{ inputs.project }}
         RELEASE_VERSION: ${{ inputs.release-version }}
+        VERSION_OR_UNSTABLE: ${{ github.ref_type == 'tag' && inputs.release-version || 'unstable' }}
         PACKAGER: ${{ inputs.packager }}
         PKG_ARCH: ${{ inputs.pkg-arch }}
         GO_NAME: ${{ inputs.go-name }}
@@ -76,17 +81,12 @@ runs:
             ;;
         esac
 
-        if [ -z "$RELEASE_VERSION" ] || [ "$RELEASE_VERSION" = "main" ]; then
-          version_or_unstable="unstable"
-        else
-          version_or_unstable="$RELEASE_VERSION"
-        fi
-        echo "VERSION_OR_UNSTABLE=$version_or_unstable" >> "$GITHUB_ENV"
+        echo "VERSION_OR_UNSTABLE=$VERSION_OR_UNSTABLE" >> "$GITHUB_ENV"
         echo "BINARIES_ARTIFACT_NAME=${PROJECT}_bins" >> "$GITHUB_ENV"
         echo "BINARY_GLOB=${PROJECT}-*-${GO_NAME}" >> "$GITHUB_ENV"
-        echo "PACKAGE_FILENAME=${PROJECT}-${version_or_unstable}-${PKG_ARCH}.${PACKAGER}" >> "$GITHUB_ENV"
+        echo "PACKAGE_FILENAME=${PROJECT}-${VERSION_OR_UNSTABLE}-${PKG_ARCH}.${PACKAGER}" >> "$GITHUB_ENV"
         echo "ARTIFACT_NAME=${PROJECT}_os_package_${PACKAGER}_${PKG_ARCH}" >> "$GITHUB_ENV"
-        echo "S3_TARGET_PATH=/${PROJECT}/${version_or_unstable}" >> "$GITHUB_ENV"
+        echo "S3_TARGET_PATH=/${PROJECT}/${VERSION_OR_UNSTABLE}" >> "$GITHUB_ENV"
 
     - name: Download project binaries
       uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7