diff --git a/.github/workflows/iso-1-github-tag.yml b/.github/workflows/iso-1-github-tag.yml
index e8fa59c..76e9937 100644
--- a/.github/workflows/iso-1-github-tag.yml
+++ b/.github/workflows/iso-1-github-tag.yml
@@ -65,20 +65,10 @@ jobs:
 
           $section"
           # One ISO per day and kind: the newest build of a day replaces the earlier one (space), here and on the mirror.
-          mirror_sync() { [ -n "$GIT_UPRISER_TOKEN" ] && curl -fsS --retry 5 --retry-delay 10 --retry-all-errors -X POST -H "Authorization: token $GIT_UPRISER_TOKEN" "$GITEA_URL/api/v1/repos/$GITEA_REPO/mirror-sync" > /dev/null; }
           if git ls-remote --exit-code --tags origin "refs/tags/$tag" > /dev/null 2>&1 || gh release view "$tag" > /dev/null 2>&1; then
             echo "$tag exists: replacing it"
             gh release delete "$tag" --cleanup-tag -y 2> /dev/null || true
             git push origin ":refs/tags/$tag" 2> /dev/null || true
-            # The mirror has to see the tag go (it drops the tag and its release with the ISO); otherwise the new tag is only an
-            # update there and starts no build.
-            if mirror_sync; then
-              # The tag list, not .../tags/<tag>: that URL answers 404 on this server even for tags that exist.
-              for _ in $(seq 36); do
-                curl -s "$GITEA_URL/api/v1/repos/$GITEA_REPO/tags?limit=100" | grep -q "\"name\":\"$tag\"" || break
-                sleep 5
-              done
-            fi
           fi
           # An annotated tag: its own date, so the mirror sorts releases on the same commit in order (a
           # lightweight tag only has its commit's date).
@@ -87,6 +77,7 @@ jobs:
           git tag -a "$tag" -m "$name" "$GITHUB_SHA" && git push origin "refs/tags/$tag"
           gh release create "$tag" --verify-tag $pre --title "$name" --notes "$notes"
           echo "Released $tag"
+          echo "ISO_TAG=$tag" >> "$GITHUB_ENV"
 
           # Retention (space): at most 10 dev and 10 real releases; the oldest go, release and tag. The mirror drops the
           # tag with its release and ISO at its next sync (the step below).
@@ -97,12 +88,25 @@ jobs:
               while read -r old; do echo "Retention: removing $old"; gh release delete "$old" --cleanup-tag -y; done
           done
 
-      # Optional: sync the mirror at once instead of at its interval (a Gitea token with repository write
-      # access as the secret GIT_UPRISER_TOKEN).
-      - name: Sync the Gitea mirror
+      # The mirror takes the tag (sync), then the build on the mirror is started explicitly (its dispatch API): a tag that
+      # is replaced (same name, a new tag object) starts no run there by itself. Needs a Gitea token with repository write
+      # access as the secret GIT_UPRISER_TOKEN; without it the mirror picks the tag up later and nothing is built.
+      - name: Sync the Gitea mirror and start its build
         env:
           GIT_UPRISER_TOKEN: ${{ secrets.GIT_UPRISER_TOKEN }}
         run: |
-          if [ -z "$GIT_UPRISER_TOKEN" ]; then echo "No GIT_UPRISER_TOKEN: the mirror picks the tag up at its next sync."; exit 0; fi
-          curl -fsS --retry 5 --retry-delay 10 --retry-all-errors -X POST -H "Authorization: token $GIT_UPRISER_TOKEN" "$GITEA_URL/api/v1/repos/$GITEA_REPO/mirror-sync" &&
-            echo "Mirror sync started"
+          if [ -z "$GIT_UPRISER_TOKEN" ]; then echo "No GIT_UPRISER_TOKEN: the mirror is not synced and no build is started."; exit 0; fi
+          api="$GITEA_URL/api/v1/repos/$GITEA_REPO"
+          curl -fsS --retry 5 --retry-delay 10 --retry-all-errors -X POST -H "Authorization: token $GIT_UPRISER_TOKEN" "$api/mirror-sync"
+          echo "Mirror sync started"
+          want="$(git rev-parse "refs/tags/$ISO_TAG")"
+          for _ in $(seq 60); do
+            got="$(curl -s "$api/tags/$ISO_TAG" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("id",""))' 2> /dev/null)"
+            [ "$got" = "$want" ] && break
+            sleep 5
+          done
+          [ "$got" = "$want" ] || { echo "::error::the mirror does not have $ISO_TAG ($want) after 5 minutes"; exit 1; }
+          # ref: the full name (refs/tags/...), as in Gitea's API documentation; --fail-with-body shows the server's reason.
+          curl -sS --fail-with-body --retry 3 -X POST -H "Authorization: token $GIT_UPRISER_TOKEN" -H "Content-Type: application/json" \
+              -d "{\"ref\":\"refs/tags/$ISO_TAG\"}" "$api/actions/workflows/iso-2-gitea-build.yml/dispatches"
+          echo "Started the mirror's build for $ISO_TAG"
diff --git a/.github/workflows/iso-2-gitea-build.yml b/.github/workflows/iso-2-gitea-build.yml
index f0ffdc5..dbe1c2c 100644
--- a/.github/workflows/iso-2-gitea-build.yml
+++ b/.github/workflows/iso-2-gitea-build.yml
@@ -10,9 +10,9 @@
 # [repository.release] FILE_MAX_SIZE must allow the ISO (default 2 GB).
 name: ISO 2/2 · Build and publish (Gitea)
 
+# Started by iso-1-github-tag.yml through the mirror's dispatch API, with the tag as the ref (a replaced tag starts no
+# run by itself, so nothing is triggered by tag pushes).
 on:
-  push:
-    tags: ['v*']
   workflow_dispatch:
 
 # One run at a time for the whole workflow (not per tag): a new run stops the running one and takes over.
diff --git a/AGENTS.md b/AGENTS.md
index 7224a8c..a79d379 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -118,9 +118,9 @@ Full write-up, with every trap: `steamify-iso-release` in steamify-cachyos-dev.
   release, whose `bundle.yml` needs the secret `ISO_DISPATCH_TOKEN`) names the release like CachyOS does, by the day (GitHub's UTC
   date, no time): `vX.Y.Z-YYMMDD` (real) or `vX.Y.Z-dev-YYMMDD` (dev), file `steamify-cachyos-X.Y.Z-[dev-]YYMMDD-x86_64.iso`, an **annotated** tag and a
   release with notes and the direct download link. One ISO per day and kind: a second build the same day deletes
-  the earlier release and tag (GitHub), waits until the mirror has dropped them, then tags again. Retention: at most 10 dev and 10 real
+  the earlier release and tag (GitHub) and tags again; the mirror takes the new tag object, iso-2 replaces the old mirror release. Retention: at most 10 dev and 10 real
   releases are kept (space); the oldest are deleted with `gh release delete --cleanup-tag`, and the mirror drops their tags, releases and ISOs at its next sync. The workflow always runs from `master`; its input `kind` (`release`, `dev`, or `auto`: release on master, dev on other branches) decides: `release` is a real release, `dev` a `dev-` pre-release. steamify-cachyos' bundle.yml passes it: a version published from main -> `release`, a version on a release branch -> `dev`.
-- `.github/workflows/iso-2-gitea-build.yml` (Gitea, `on: push: tags: v*`, skipped on GitHub) runs two jobs for that
+- `.github/workflows/iso-2-gitea-build.yml` (Gitea, `workflow_dispatch` with the tag as the ref, started by iso-1's last step through the mirror's dispatch API after the mirror has the new tag object; a tag push starts nothing, because a replaced tag of the same name starts no run; skipped on GitHub) runs two jobs for that
   tag: build the ISO, then attach it to the mirror's release. It is not tested there (the runner is small): the VM tests
   run on GitHub, in steamify-cachyos `vmtest.yml`, on the newest ISO release of the mirror. The tag decides everything: Steamify version (`steamify-prepare.sh`
   takes `STEAMIFY_VERSION`), file name (`STEAMIFY_ISO_VERSION` -> `iso_version` in `profiledef.sh`), label