diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 640afbdf01..a160202e90 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -144,7 +144,7 @@ jobs:
         with:
           name: meshcentral
           repository: ${{ github.repository }}/helm-charts
-          tag: ${{ needs.version.outputs.version }}
+          tag: ${{ needs.version.outputs.version == 'latest' && '9.9.9' || needs.version.outputs.version }}
           path: ./charts/meshcentral
           registry: ${{ env.REGISTRY }}
           registry_username: ${{ github.actor }}
@@ -154,6 +154,7 @@ jobs:
   release:
     name: "Create Release"
     needs: [version, build, build_helm]
+    if: ${{ !failure() && !cancelled() }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index 37f882e6b5..e45591fa6d 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -37,11 +37,8 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Releases, not git tags: upstream's inherited bare tags and the 9.9.x sentinel outrank the real line under sort -V
-          latest=$(gh release list --limit 100 --exclude-drafts --exclude-pre-releases \
-            --json tagName --jq '.[].tagName' \
-            | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | grep -v '^9\.9\.' | sort -V | tail -1 || true)
-          latest=${latest:-0.0.0}
+          latest=$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name)
+          [[ "$latest" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Latest release tag '${latest}' is not x.y.z"; exit 1; }
           IFS='.' read -r cur_major cur_minor cur_patch <<< "$latest"
 
           if [ -z "$INPUT_VERSION" ]; then