diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index a1c115f..5d3398a 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -452,6 +452,18 @@ jobs:
        # to. Same source of truth; no double-store.
 
   build-web:
+    # Consumed by smoke-web's job-level `if:`. It cannot read `env` — the env
+    # context is available to STEP `if:` and step bodies, never to a job's own
+    # condition, and an unresolvable context there is empty rather than an
+    # error. `smoke-web` skipped silently on run 5290 for exactly that reason.
+    #
+    # Keying off the reuse step's own output is better than re-deriving the
+    # trigger anyway: it is the same single decision the build, the XPI
+    # download and the promote all take (build.yml's "one decision drives
+    # everything downstream"), and it says the thing smoke-web actually needs
+    # to know — a candidate was published — rather than restating why.
+    outputs:
+      candidate: ${{ steps.reuse.outputs.promote }}
     # A plain `needs` — no `always()`. That expression existed to let a
     # SKIPPED sign-extension through on a tag push while still blocking a
     # FAILED one. With no tag trigger, sign-extension always runs, so the
@@ -1123,8 +1135,8 @@ jobs:
   # time anyone saw this job run would also be the first time it could stop a
   # publish.
   smoke-web:
-    if: env.IS_REFRESH == 'true'
     needs: [build-web]
+    if: needs.build-web.outputs.candidate == 'true'
     runs-on: python-ci
     container:
       image: git.fabledsword.com/bvandeusen/ci-python:3.14