diff --git a/.github/workflows/nightly-release.yml b/.github/workflows/nightly-release.yml
index f2a4b70..770e58d 100644
--- a/.github/workflows/nightly-release.yml
+++ b/.github/workflows/nightly-release.yml
@@ -205,6 +205,7 @@ jobs:
       version: ${{ steps.v.outputs.version }}
       dated_tag: ${{ steps.v.outputs.dated_tag }}
       title: ${{ steps.v.outputs.title }}
+      sha: ${{ steps.v.outputs.sha }}
     steps:
       - name: Require RELEASE_TOKEN (else no-op)
         id: token
@@ -236,12 +237,14 @@ jobs:
           BASE="$(crg)"                      # e.g. 0.13.2 (the current Cargo.toml version)
           DATE="$(date -u +%Y%m%d)"          # e.g. 20260714 (UTC)
           DATE_DASH="$(date -u +%Y-%m-%d)"   # e.g. 2026-07-14 (UTC, for the human title)
-          SHA="$(git rev-parse --short HEAD)"
+          SHORTSHA="$(git rev-parse --short HEAD)"
+          FULLSHA="$(git rev-parse HEAD)"
           # Semver PRERELEASE version — sorts BELOW the plain `X.Y.Z`, so a nightly never outranks
           # the stable release of the same version. Built at CI time; never committed.
-          echo "version=${BASE}-nightly.${DATE}.${SHA}" >> "$GITHUB_OUTPUT"
+          echo "version=${BASE}-nightly.${DATE}.${SHORTSHA}" >> "$GITHUB_OUTPUT"
           echo "dated_tag=nightly-${DATE}" >> "$GITHUB_OUTPUT"
-          echo "title=Nightly ${DATE_DASH} (${SHA})" >> "$GITHUB_OUTPUT"
+          echo "title=Nightly ${DATE_DASH} (${SHORTSHA})" >> "$GITHUB_OUTPUT"
+          echo "sha=${FULLSHA}" >> "$GITHUB_OUTPUT"
 
   # 2) build: the SAME reusable cross-OS build the stable release uses, stamped with the nightly
   #    version. Skipped (with the whole channel) when the token is absent.
@@ -252,7 +255,7 @@ jobs:
     uses: ./.github/workflows/build-binaries.yml
     with:
       version: ${{ needs.nightly-meta.outputs.version }}
-      ref: "" # build this run's commit (main HEAD)
+      ref: ${{ needs.nightly-meta.outputs.sha }}
 
   # 3) publish: attach the built binaries to a dated + rolling PRE-release, then prune old
   #    nightlies. Uses RELEASE_TOKEN for git tag + gh release operations (same identity as stable).
diff --git a/.gitignore b/.gitignore
index 0a66648..f5cbad4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,4 +13,5 @@
 /.wp-doc-findings.md
 # Rendered whitepaper HTML intermediate (the .md source and .pdf are kept).
 /docs/whitepaper/digstore-whitepaper.html
-.testcredentials
\ No newline at end of file
+.testcredentials
+.claude/worktrees/
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index 4e82e28..83c546f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2289,7 +2289,7 @@ dependencies = [
 
 [[package]]
 name = "digstore-chain"
-version = "0.13.2"
+version = "0.13.3"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -2327,7 +2327,7 @@ dependencies = [
 
 [[package]]
 name = "digstore-chunker"
-version = "0.13.2"
+version = "0.13.3"
 dependencies = [
  "digstore-core",
  "hex",
@@ -2337,7 +2337,7 @@ dependencies = [
 
 [[package]]
 name = "digstore-cli"
-version = "0.13.2"
+version = "0.13.3"
 dependencies = [
  "anstream 0.6.21",
  "anstyle",
@@ -2403,7 +2403,7 @@ dependencies = [
 
 [[package]]
 name = "digstore-core"
-version = "0.13.2"
+version = "0.13.3"
 dependencies = [
  "aes-gcm-siv",
  "hex",
@@ -2500,7 +2500,7 @@ dependencies = [
 
 [[package]]
 name = "digstore-remote"
-version = "0.13.2"
+version = "0.13.3"
 dependencies = [
  "async-trait",
  "axum",
diff --git a/Cargo.toml b/Cargo.toml
index 9b821ee..1fcccc6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ exclude = ["crates/digstore-prover/guest", "crates/dig-client-wasm"]
 
 [workspace.package]
 edition = "2021"
-version = "0.13.2"
+version = "0.13.3"
 license = "GPL-2.0-only"
 
 [workspace.dependencies]
diff --git a/cliff.toml b/cliff.toml
index dbe3a58..1546410 100644
--- a/cliff.toml
+++ b/cliff.toml
@@ -1,7 +1,7 @@
 # git-cliff changelog config — builds CHANGELOG.md from Conventional Commits.
-# Uniform across every DIG repo (Rust + JS/TS). Consumed by .github/workflows/release.yml,
-# which regenerates the changelog on merge and commits it BEFORE tagging (so the changelog
-# is included in the vX.Y.Z tag). See CLAUDE.md §3.6.
+# Uniform across every DIG repo (Rust + JS/TS). Consumed by nightly-release.yml's stable
+# channel (the nightly cron + manual dispatch), which regenerates the changelog + commits + tags.
+# See CLAUDE.md §3.6.
 [changelog]
 header = """
 # Changelog