diff --git a/.forgejo/workflows/pipeline.yml b/.forgejo/workflows/pipeline.yml
index f3a1a29..f7c21b5 100644
--- a/.forgejo/workflows/pipeline.yml
+++ b/.forgejo/workflows/pipeline.yml
@@ -124,9 +124,6 @@ jobs:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: publish
     runs-on: docker
-    env:
-      API_IMAGE: git.fiwlabs.dev/fiwdev/nereus-api:${{ github.sha }}
-      LOADGEN_IMAGE: git.fiwlabs.dev/fiwdev/nereus-loadgen:${{ github.sha }}
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
@@ -162,13 +159,21 @@ jobs:
 
           kube get secret nereus-db --namespace nereus >/dev/null
           kube apply -k deploy/observability
-          kube apply -k deploy/overlays/prod
-          kube patch rollout.argoproj.io nereus-api --namespace nereus --type json \
-            --patch "[{\"op\":\"replace\",\"path\":\"/spec/template/spec/containers/0/image\",\"value\":\"$API_IMAGE\"}]"
-          kube set image deployment/nereus-loadgen --namespace nereus \
-            "loadgen=$LOADGEN_IMAGE"
-          kube set image deployment/nereus-loadgen-preview --namespace nereus \
-            "loadgen=$LOADGEN_IMAGE"
+
+          # Set the built tag before applying. Applying the overlay first would
+          # roll out its pinned 0.1.0 tag and then roll out a second time on the
+          # patch, running the pre-promotion analysis against the wrong image.
+          install -d .ci/release
+          cat >.ci/release/kustomization.yaml <<'EOF'
+          resources:
+            - ../../deploy/overlays/prod
+          images:
+            - name: git.fiwlabs.dev/fiwdev/nereus-api
+              newTag: ${{ github.sha }}
+            - name: git.fiwlabs.dev/fiwdev/nereus-loadgen
+              newTag: ${{ github.sha }}
+          EOF
+          kube apply -k .ci/release
 
           kube rollout status deployment/nereus-loadgen --namespace nereus --timeout=5m
           kube rollout status deployment/nereus-loadgen-preview --namespace nereus --timeout=5m