diff --git a/.github/workflows/downstream-release.yml b/.github/workflows/downstream-release.yml
index b7ff720fe890..0de07f4736a3 100644
--- a/.github/workflows/downstream-release.yml
+++ b/.github/workflows/downstream-release.yml
@@ -66,6 +66,31 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "upstream_version=$upstream_version" >> "$GITHUB_OUTPUT"
           echo "build_date=$(git show -s --format=%cI "$source_sha")" >> "$GITHUB_OUTPUT"
+      # Every release re-signs the bundled packages. An installed immutable plugin
+      # version cannot take different bytes, so a reused version leaves the plugin
+      # manager degraded and every gateway request unavailable after deploy.
+      - name: Require new bundled plugin versions
+        shell: bash
+        run: |
+          set -euo pipefail
+          previous=$(git tag --merged HEAD --list 'v*.*.*-codexrip.*' --sort=-v:refname | grep -vxF "$RELEASE_TAG" | head -n1 || true)
+          if [[ -z "$previous" ]]; then
+            echo 'No earlier release tag on this history; nothing to compare.'
+            exit 0
+          fi
+          reused=()
+          for manifest in plugins/*/manifest.source.json; do
+            # A plugin added since the previous release has nothing to compare.
+            git cat-file -e "$previous:$manifest" 2>/dev/null || continue
+            current=$(jq -r .version "$manifest")
+            before=$(git show "$previous:$manifest" | jq -r .version)
+            [[ "$current" != "$before" ]] || reused+=("$(basename "$(dirname "$manifest")")@$current")
+          done
+          if ((${#reused[@]})); then
+            echo "::error::Bundled plugin versions unchanged since $previous: ${reused[*]}. Bump every bundled plugin before tagging."
+            exit 1
+          fi
+          echo "Bundled plugin versions all differ from $previous."
       # Required PR checks admit code to main. Reuse that validation here;
       # publishing verifies immutable source metadata and builds the artifact,
       # rather than rerunning source, frontend, race or migration test suites.
diff --git a/.github/workflows/production-deploy.yml b/.github/workflows/production-deploy.yml
index 0fa0110a0f94..fed1f3a522f7 100644
--- a/.github/workflows/production-deploy.yml
+++ b/.github/workflows/production-deploy.yml
@@ -353,8 +353,10 @@ jobs:
             -p "$VPS_PORT" \
             "${VPS_USER}@${VPS_HOST}" \
             "$remote_command"
+      # The recreated container needs time for migrations and plugin bootstrap; the
+      # edge answers 502/503 until then, so keep retrying for up to three minutes.
       - name: Verify public health
         env:
           PUBLIC_HEALTH_URL: ${{ secrets.PUBLIC_HEALTH_URL }}
         shell: bash
-        run: curl --fail --silent --show-error --retry 3 --retry-delay 2 --max-time 30 "$PUBLIC_HEALTH_URL" >/dev/null
+        run: curl --fail --silent --show-error --retry 36 --retry-delay 5 --retry-max-time 180 --retry-connrefused --max-time 30 "$PUBLIC_HEALTH_URL" >/dev/null