diff --git a/scripts/release.sh b/scripts/release.sh
index 239b0b2..c0b42f9 100644
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -61,9 +61,14 @@ fi
 # ── 3. Commit + push ──────────────────────────────────────────────────────
 echo "[3/6] Committing + pushing"
 git add dashcaddy-api/package.json
-# status/dist/ is .gitignored but its tracked files still need re-staging on rebuild.
-# -f bypasses the ignore for these specific paths.
+# Everything the build rewrites must be staged or the tarball ships stale
+# copies. status/dist/ is .gitignored (-f bypasses); index.html and sw.js are
+# tracked but get rewritten by build.js (CSP hash + SW cache tag derived from
+# bundle content). Without staging sw.js, clients keep the old cache name
+# and never see the new bundles.
 [[ -d status/dist ]] && git add -f status/dist/ 2>/dev/null || true
+[[ -f status/index.html ]] && git add status/index.html 2>/dev/null || true
+[[ -f status/sw.js ]] && git add status/sw.js 2>/dev/null || true
 git commit -m "chore(release): bump to $VERSION" >/dev/null
 git push gitea main >/dev/null
 COMMIT="$(git rev-parse --short HEAD)"
diff --git a/status/sw.js b/status/sw.js
index 9cf13da..ffaa006 100644
--- a/status/sw.js
+++ b/status/sw.js
@@ -1,4 +1,4 @@
-const CACHE = 'dashcaddy-shell-48970e1876';
+const CACHE = 'dashcaddy-shell-8ef9c82616';
 const PRECACHE = [
   '/',
   '/index.html',