diff --git a/.github/workflows/desktop-bundled-release.yml b/.github/workflows/desktop-bundled-release.yml
index f695a1bbf1..4673112d97 100644
--- a/.github/workflows/desktop-bundled-release.yml
+++ b/.github/workflows/desktop-bundled-release.yml
@@ -193,13 +193,13 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ (inputs.build_commit != '' || inputs.channel != '') && github.sha || inputs.tag }}
-          # Tag admission runs merge-base against origin/main and needs the
-          # shared ancestry; channel admission exits before any history read,
-          # so it fetches exactly one commit. Commit admission reads ancestry
-          # (require_pushed) and pyproject.toml at BUILD_COMMIT, so it needs
-          # the full graph.
-          fetch-depth: ${{ inputs.build_commit != '' && 0 || (inputs.channel != '' && 1 || 0) }}
-          fetch-tags: ${{ inputs.build_commit == '' && inputs.channel == '' }}
+          # Full checkout, always. Commit admission (require_pushed) needs the
+          # full graph AND every pushed branch ref fetched into
+          # refs/remotes/origin/* — a depth-1 checkout fetches only github.sha,
+          # so it can't see the branch that actually carries build_commit.
+          # Tag admission runs merge-base against origin/main and needs tags.
+          fetch-depth: 0
+          fetch-tags: true
 
       - name: Set up native identity reader
         if: inputs.disposable_channel != '' && inputs.disposable_receivers