diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 330508662c..8668869fd8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -72,6 +72,7 @@ jobs:
 
       - name: Select pinned Xcode
         run: |
+          [[ -f .xcode-version ]] || { echo "::error::This release workflow requires a source tag containing .xcode-version; do not rewrite older tags."; exit 1; }
           export DEVELOPER_DIR="/Applications/Xcode_$(cat .xcode-version).app/Contents/Developer"
           scripts/check-xcode.sh
           echo "DEVELOPER_DIR=$DEVELOPER_DIR" >> "$GITHUB_ENV"
@@ -291,6 +292,7 @@ jobs:
 
       - name: Select pinned Xcode
         run: |
+          [[ -f .xcode-version ]] || { echo "::error::This release workflow requires a source tag containing .xcode-version; do not rewrite older tags."; exit 1; }
           export DEVELOPER_DIR="/Applications/Xcode_$(cat .xcode-version).app/Contents/Developer"
           scripts/check-xcode.sh
           echo "DEVELOPER_DIR=$DEVELOPER_DIR" >> "$GITHUB_ENV"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b20433b992..f134626afb 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -125,6 +125,11 @@ preview, even though the selected Xcode 27.0 compiler is stable. When changing
 the pin, verify runner availability and coordinate the internal release
 pipeline's scheduling pin in `squareup/buzz-releases`.
 
+Release tags are immutable. This GitHub release workflow reads the pin from
+the tagged source and requires a tag that contains it; it does not retrofit
+older tags. Internal release jobs explicitly support older tags without a
+pin using their release-repository pin, and reject a conflicting source pin.
+
 #### Linux: Tauri system libraries
 
 Hermit pins language toolchains, not system libraries. On Linux, the desktop