diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index 09fea05..a05f01f 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -37,8 +37,6 @@ jobs:
       SCCACHE_DIR: /var/local/sccache
       SCCACHE_SERVER_PORT: "4228"
       CARGO_TARGET_DIR: /var/local/cargo-target
-      # The iris release shipped in this portal release's tarball.
-      IRIS_RELEASE: v0.1.1
       # cargo-leptos's own downloaded tools (wasm-bindgen, wasm-opt) cache
       # under $XDG_CACHE_HOME - left at its default that resolves inside
       # this unit's systemd StateDirectory, files it creates there end up
@@ -58,18 +56,51 @@ jobs:
       - name: Build
         run: SITE_NAME=${{ vars.PORTAL_SITE_NAME }} cargo leptos build --release
 
-      # cargo-leptos only builds the leptos bin-target ("portal") - the
-      # question-lint utility binary needs its own plain cargo build.
-      # The lint lives in uhhm/iris and is pinned to the portal release it
-      # matches; shipping it in the tarball keeps a site that pins nothing
-      # extra lint-capable at /srv/app/<instance>/current/iris.
-      - name: Build iris
+      # The lint (uhhm/iris) is versioned as portal: this step re-pins
+      # iris to the tag being released, builds and tests it against it,
+      # and pushes the matching iris tag, which iris's own CI publishes.
+      # A portal change to something the lint reads fails the release
+      # right here. Needs IRIS_PUSH_USER (a variable) and IRIS_PUSH_TOKEN
+      # (a secret) that may push to uhhm/iris; the workflow's own token
+      # is scoped to this repo. A re-run of a tag whose iris tag already
+      # exists just builds that.
+      - name: Release iris to match
         env:
           # The shared cargo home is read-only for the runner, and a git
           # dependency has to be cloned into one (same as uhhm/iris's CI).
           CARGO_HOME: /var/local/cargo-target/iris-cargo-home
           RUSTC_WRAPPER: /usr/bin/sccache
-        run: cargo install --git "${{ github.server_url }}/uhhm/iris.git" --tag "$IRIS_RELEASE" --root "$CARGO_TARGET_DIR/iris-install" --force iris
+          IRIS_PUSH_USER: ${{ vars.IRIS_PUSH_USER }}
+          IRIS_PUSH_TOKEN: ${{ secrets.IRIS_PUSH_TOKEN }}
+        run: |
+          set -euo pipefail
+          tag="${{ github.ref_name }}"
+          ver="${tag#v}"
+          host="${{ github.server_url }}"
+          rm -rf iris-src
+          git clone -q "$host/uhhm/iris.git" iris-src
+          cd iris-src
+          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+            echo "iris $tag already exists, building it"
+            git checkout -q "$tag"
+          else
+            sed -i -E "s|^(portal = \{ git = \"[^\"]+\", tag = \")[^\"]+(\")|\1$tag\2|" Cargo.toml
+            sed -i -E "0,/^version = \"[^\"]+\"/s//version = \"$ver\"/" Cargo.toml
+            cargo update -q -p portal
+            awk -v h="## $ver ($(date -u +%F)) - portal $tag" -v l="- Matches portal $tag (released by portal's publish job)." \
+              'done==0 && /^## /{print h; print ""; print l; print ""; done=1} {print}' CHANGELOG.md > CHANGELOG.new
+            mv CHANGELOG.new CHANGELOG.md
+          fi
+          cargo build --release
+          cargo test
+          if ! git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+            git config user.name "portal release"
+            git config user.email "portal@uhhm.no"
+            git commit -qam "Match portal $tag"
+            git tag "$tag"
+            git push -q "https://${IRIS_PUSH_USER}:${IRIS_PUSH_TOKEN}@${host#https://}/uhhm/iris.git" main "$tag"
+            echo "pushed iris $tag"
+          fi
 
       - name: Package
         run: |
@@ -77,7 +108,7 @@ jobs:
           tag="${{ github.ref_name }}"
           stage=$(mktemp -d)
           cp "$CARGO_TARGET_DIR/release/portal" "$stage/portal"
-          cp "$CARGO_TARGET_DIR/iris-install/bin/iris" "$stage/iris"
+          cp "$CARGO_TARGET_DIR/release/iris" "$stage/iris"
           # hash-files = true: leptos resolves hash.txt next to the running
           # binary, so it ships beside portal in the release dir.
           cp "$CARGO_TARGET_DIR/release/hash.txt" "$stage/hash.txt"
diff --git a/README.md b/README.md
index 6bc0619..4a218d3 100644
--- a/README.md
+++ b/README.md
@@ -98,9 +98,11 @@ stream.
 
 - `portal` — the server (Leptos SSR + hydrate, Axum underneath).
 - `iris` — the lint, from [uhhm/iris](https://project.uhhm.no/uhhm/iris),
-  which depends on this crate as a library pinned to a release tag.
-  Every release tarball ships the matching `iris` binary
-  (`IRIS_RELEASE` in `publish.yml`), so each content repo's CI can
+  which depends on this crate as a library pinned to a release tag and
+  carries the same version: the publish job here re-pins, tests and tags
+  iris for every portal release.
+  Every release tarball ships that `iris` binary
+  too, so each content repo's CI can
   lint with the exact portal version its instance runs:
   `iris check --path <dir>`.