diff --git a/README.md b/README.md
index 4e3bdf5..42bfd85 100644
--- a/README.md
+++ b/README.md
@@ -39,15 +39,19 @@ what sits around those.
 ## Matching the site
 
 Every type iris reads is portal's own: portal is a library dependency
-pinned to a release tag in `Cargo.toml`, and `iris --version` says
-which. A content repo should run the iris that matches the portal
-release its site runs. Portal's own release tarball ships an `iris`
-binary built the same way, so a site that pins nothing extra has one
-at `/srv/app/<instance>/current/iris`.
+pinned to a release tag in `Cargo.toml`, and iris carries the same
+version number as that tag, so `iris v0.3.39` is the lint for portal
+v0.3.39 and nothing else. A content repo pins `IRIS_RELEASE` to the
+`PORTAL_RELEASE` its site runs. Portal's own release tarball ships the
+matching `iris` binary too, at `/srv/app/<instance>/current/iris`.
 
 ## Release
 
-Move the `Unreleased` lines in `CHANGELOG.md` under a heading for the
-version, bump `Cargo.toml`, commit, tag `v<version>`, push. CI builds
-the binary and attaches it to the Gitea release as `iris`, with that
-section as the notes.
+Iris is released by portal's publish job, never by hand: when a
+portal tag is pushed, that job re-pins this crate to the tag, sets
+the version to match, builds and tests it, adds the changelog line,
+and pushes the commit and the tag here. This repo's own CI then
+attaches the binary to the Gitea release as `iris`. A portal change
+to something the lint reads fails the portal release at that step.
+Changes to iris itself land on `main` between releases and ship with
+the next portal tag.
diff --git a/src/main.rs b/src/main.rs
index 2c24282..0765b57 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -38,19 +38,17 @@ async fn main() -> anyhow::Result<()> {
             replay::run(argv).await
         }
         Some("--version") | Some("-V") => {
-            println!("iris {} (portal {})", env!("CARGO_PKG_VERSION"), PORTAL_TAG);
+            println!("iris {v} (portal v{v})", v = env!("CARGO_PKG_VERSION"));
             Ok(())
         }
         Some(flag) if flag.starts_with("--") => check::run(argv).await,
         _ => {
             eprintln!(
-                "iris {} - matches portal {PORTAL_TAG}\n\nusage:\n  iris check (--repo <gitea-url> [--branch main] [--subdir questions] | --path <dir>) [--needs-tasks <out.jsonl> [--skim]] [--needs-sim <model.json>] [--needs-score <answers.jsonl> [--min-accuracy 0.8]]\n  iris replay --path <dir> --nats <url> (--cases <cases.jsonl> | --report-only)",
-                env!("CARGO_PKG_VERSION")
+                "iris {v} - matches portal v{v}\n\nusage:\n  iris check (--repo <gitea-url> [--branch main] [--subdir questions] | --path <dir>) [--needs-tasks <out.jsonl> [--skim]] [--needs-sim <model.json>] [--needs-score <answers.jsonl> [--min-accuracy 0.8]]\n  iris replay --path <dir> --nats <url> (--cases <cases.jsonl> | --report-only)",
+                v = env!("CARGO_PKG_VERSION")
             );
             std::process::exit(2)
         }
     }
 }
 
-/// The portal release this iris was built against (see Cargo.toml).
-const PORTAL_TAG: &str = "v0.3.36";