diff --git a/.forgejo/workflows/android.yml b/.forgejo/workflows/android.yml
index 5449d4a..529e013 100644
--- a/.forgejo/workflows/android.yml
+++ b/.forgejo/workflows/android.yml
@@ -324,7 +324,7 @@ jobs:
   server-image:
     name: Build the server image
     needs: [decide, rust, build]
-    if: always() && needs.decide.outputs.build == 'true' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
+    if: needs.decide.outputs.build == 'true' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main')
     runs-on: flutter-ci
     container:
       # The image the dispatch has always run in, so its curl is a known quantity.
@@ -337,15 +337,15 @@ jobs:
       # push that touches the Android app (its `gate` job) and waits to be called
       # from here — that is the other half of this.
       #
-      # `always()`: a FAILED Android build — or failed core checks, which skip the
-      # build job entirely — must still let the server image through. There is no
-      # new client in that case, so it bakes in the previous one, which is exactly
-      # right — the alternative is a broken Android lane silently blocking server
-      # delivery. Its own job for that reason: a step inside `build` never runs
-      # when `build` is skipped.
+      # No `always()`: a red core check or APK build means no image for this
+      # commit (rule 177, #5419). This used to run regardless, on the reasoning that
+      # a broken Android lane shouldn't block server delivery, and the image would
+      # bake in the previous client. Run 8839 is what that meant: `:<sha>` published
+      # for 0ecdbfe while its APK lane (8835) was red, holding a client that wasn't
+      # from that commit. The previous `:dev` stays where it is; fix forward.
       #
-      # Not `if: success()` and not skipped on tags either: every ref that builds an
-      # image needs the call, or nothing builds one at all.
+      # Not skipped on tags: every ref that builds an image needs the call, since
+      # ci.yml stands down on these pushes and nothing else builds one.
       - name: Build the server image now the client is published
         env:
           GITHUB_TOKEN: ${{ github.token }}