diff --git a/scripts/publish.sh b/scripts/publish.sh
index ac26be2..1507093 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -31,6 +31,27 @@ UV_PUBLISH_USERNAME=__token__ UV_PUBLISH_PASSWORD="$TOKEN" uv publish dist/*
 # Only tag once the upload succeeded, so a failed publish leaves no tag behind.
 echo "==> committing and tagging v$VERSION"
 git add pyproject.toml uv.lock packages/server/src/mdl_server/static
-git commit -m "Release $VERSION"
-git tag "v$VERSION"
-git push && git push --tags
+
+# Commit the version bump ONLY if it isn't already committed. When the bump landed
+# via a merged PR (the common case), the tree is clean here and `git commit` would
+# abort the whole script under `set -e`, skipping the tag/push below — the exact bug
+# that left v0.6.10 published but untagged. `git diff --cached --quiet` is 0 when there
+# is nothing staged, so we commit only when there IS.
+if git diff --cached --quiet; then
+  echo "    version $VERSION already committed; tagging the current commit"
+else
+  git commit -m "Release $VERSION"
+fi
+
+# Tag the commit that actually carries this version (HEAD now does, either way).
+# Skip if the tag already exists (a re-run after a partial publish) so it never aborts.
+if git rev-parse -q --verify "refs/tags/v$VERSION" >/dev/null; then
+  echo "    tag v$VERSION already exists; leaving it in place"
+else
+  git tag "v$VERSION"
+fi
+
+# Push the current branch and the tag. Pushing the tag is what release consumers rely
+# on, so do it even when the branch push is a no-op (already up to date).
+git push
+git push origin "v$VERSION"