diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c066f0ec..0555a00b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -133,7 +133,12 @@ jobs:
 
   binaries:
     needs: version
-    if: needs.version.outputs.created == 'true'
+    # `!cancelled()` is load-bearing: `version` runs past a SKIPPED `corpus` (nightly) via its own
+    # status-function `if`, but without a status function here GitHub would propagate that skip down the
+    # `needs` chain and skip `binaries` regardless of `created` — so a nightly release got no binaries.
+    # With it, the skip no longer propagates and the real gate (`version` succeeded, a release was cut)
+    # decides. `created` is empty when `version` itself was skipped (rc/latest/stable with a red corpus).
+    if: ${{ !cancelled() && needs.version.result == 'success' && needs.version.outputs.created == 'true' }}
     uses: ./.github/workflows/build-binaries.yml
     permissions:
       contents: write
@@ -150,7 +155,9 @@ jobs:
   # The bare `<ring>` tags don't collide with the `<version>-<ring>` tags `versioning` matches on.
   promote:
     needs: [version, binaries]
-    if: needs.version.outputs.created == 'true'
+    # Same status-function requirement as `binaries`: only mirror the rolling ring release when the
+    # binaries actually built (`binaries` succeeded — which already implies a release was cut).
+    if: ${{ !cancelled() && needs.binaries.result == 'success' }}
     runs-on: ubuntu-24.04
     permissions:
       contents: write