diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a39c4c2..c9596ef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -488,9 +488,16 @@ jobs:
           set -eu
 
           # Checked before use, because an unset secret is not an error anywhere upstream of
-          # here: ${{ }} renders a missing value as the empty string, so docker is handed
-          # --username "" and answers with something about credentials, which sends people
-          # to the registry to debug a value that never left the settings page.
+          # here: an expression that resolves to nothing renders as the empty string, so
+          # docker is handed --username "" and answers with something about credentials,
+          # which sends people to the registry to debug a value that never left the
+          # settings page.
+          #
+          # Note for anyone editing this comment: an expression delimiter written literally
+          # here is interpolated even though this is a shell comment. The runner substitutes
+          # the whole script before any shell sees it, so an empty one fails the step with a
+          # parse error and no line number — which is how this very block broke the release
+          # it was added to protect.
           #
           # Reported by length, and never by value. Gitea masks known secret values in logs,
           # but a mask is only as good as the runner's bookkeeping and a length answers the