diff --git a/desktop/packaging/write-manifest.sh b/desktop/packaging/write-manifest.sh
index 4e4030b..71195e7 100644
--- a/desktop/packaging/write-manifest.sh
+++ b/desktop/packaging/write-manifest.sh
@@ -168,9 +168,21 @@ if [ "${PRUNE_OLD_ASSETS:-false}" = "true" ]; then
     | while IFS= read -r row; do
         asset_id="$(printf '%s' "$row" | grep -oE '[0-9]+' | head -1)"
         asset_name="$(printf '%s' "$row" | sed -E 's/.*"name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')"
-        # Keep the manifest itself and everything belonging to the current build.
+        # Keep FIXED-NAME assets and everything belonging to the current build.
+        #
+        # A fixed name is self-limiting: each publish replaces that same name, so
+        # it cannot accumulate and the reason this prune exists does not apply to
+        # it. It is also the only kind of URL that stays addressable on a rolling
+        # tag, which is the whole point of having one — deleting it breaks
+        # whatever was pointing at it.
+        #
+        # The Android client is on that list for a second reason too: it is built
+        # by a DIFFERENT workflow with its own run number, so its version never
+        # matches $APP_VERSION here and a version-stamped name would be pruned on
+        # every desktop push regardless. That is exactly what happened on run
+        # 4098, which swept the APK run 4092 had just published.
         case "$asset_name" in
-          latest.json) continue ;;
+          latest.json|thoughtsync.apk|thoughtsync-android.json) continue ;;
           *"$APP_VERSION"*) continue ;;
         esac
         echo "    removing $asset_name"