diff --git a/docs/notes/release-checklist.md b/docs/notes/release-checklist.md
index 892ca0e..a60c159 100644
--- a/docs/notes/release-checklist.md
+++ b/docs/notes/release-checklist.md
@@ -131,6 +131,12 @@ The one nobody does until it matters.
       the chats are there, and nothing in the log says a column is missing.
 - [ ] `/admin/updates` shows a version rather than a sha, and the release notes
       come from the tag.
+- [ ] Push the **signed annotated tag first**, then make the forge Release from
+      it — never the other way round. A Release created for a tag that does not
+      exist yet makes a **lightweight** one: no message, no signature, so the
+      forge page looks right and `/admin/updates` shows blank release notes.
+      The tag is what the application reads; the Release is a second window onto
+      the same text, for people who never install it.
 - [ ] Press Update. The service restarts and comes back.
 - [ ] Re-run `install.sh`. The channel does **not** move on its own. *(0.9.12.)*
 - [ ] `sudo ls -l /usr/local/lib/lembas/update.sh` — owned by root. If systemd's