diff --git a/bin/omarchy-iso-release b/bin/omarchy-iso-release
index b0423fa..7d2a154 100755
--- a/bin/omarchy-iso-release
+++ b/bin/omarchy-iso-release
@@ -1,5 +1,10 @@
 #!/bin/bash
 
+# A failed step must stop the release: without this, a make that dies (say,
+# docker permission denied) falls through to signing and uploading whatever
+# stale ISO release/ already holds, under the new release's name.
+set -e
+
 MAKE_ARGS=()
 ISO_REF=quattro
 RELEASE_SUFFIX=""