diff --git a/scripts/changelog-codenames.mjs b/scripts/changelog-codenames.mjs
index c7bf13e..f3c2b68 100755
--- a/scripts/changelog-codenames.mjs
+++ b/scripts/changelog-codenames.mjs
@@ -16,10 +16,20 @@ if (!codenameBin) {
   process.exit(1);
 }
 
-const releases = JSON.parse(readFileSync(0, "utf8"));
+const input = readFileSync(0, "utf8").trim();
+if (!input) {
+  console.error(
+    "changelog-codenames.mjs: empty stdin — the upstream git-cliff produced no context",
+  );
+  process.exit(1);
+}
+
+const releases = JSON.parse(input);
 for (const release of releases) {
   // Unreleased sections have a null version and get no codename.
-  if (!release.version) continue;
+  if (!release.version) { 
+    continue;
+  }
   const codename = execFileSync(codenameBin, [release.version], {
     encoding: "utf8",
   }).trim();
diff --git a/scripts/release-publish.sh b/scripts/release-publish.sh
index e8d9bff..28ac5df 100755
--- a/scripts/release-publish.sh
+++ b/scripts/release-publish.sh
@@ -60,7 +60,17 @@ TITLE="$TAG \"$RELEASE_CODENAME\""
 echo "Creating GitHub release ${TAG} (${RELEASE_CODENAME})..."
 NOTES_FILE="$(mktemp)"
 trap 'rm -f "$NOTES_FILE"' EXIT
-git-cliff --current --tag "$TAG" -x 2>/dev/null \
+# Scope git-cliff to this release. Locally the tag already exists, so --current
+# selects its section; in CI the tag is created later (below), so --unreleased
+# picks up the not-yet-tagged commits and --tag names them. Using --current
+# without an existing tag fails with empty output, which would silently fall
+# back to GitHub's auto-notes.
+if git rev-parse "$TAG" >/dev/null 2>&1; then
+  CLIFF_SCOPE="--current"
+else
+  CLIFF_SCOPE="--unreleased"
+fi
+git-cliff "$CLIFF_SCOPE" --tag "$TAG" -x 2>/dev/null \
   | bun scripts/changelog-codenames.mjs "$CODENAME_BIN" \
   | git-cliff --from-context - --strip header > "$NOTES_FILE" 2>/dev/null || true