diff --git a/README.md b/README.md
index 2aba3e1..5b4e943 100644
--- a/README.md
+++ b/README.md
@@ -12,12 +12,17 @@ The filesystem no longer encodes release policy. Instead:
 
 - there are three channels forming a forward-only pipeline: `edge` → `rc` → `stable`
 - all packages build for `edge` unless their metadata pins `channels`
-- packages with `"release_ring": "fast"` also build directly for `stable`, and those
-  artifacts are replicated into `rc` in the same release run so rc and stable stay in parity
+- packages with `"release_ring": "fast"` build natively for **all three** channels —
+  each in its own image against its own base mirror, because rc's Arch snapshot may sit
+  anywhere between stable's and edge's, so an artifact linked against stable's libraries
+  is not necessarily correct for rc
 - a release train opens by advancing edge into rc (`bin/repo advance --from edge --to rc`)
   and ships by promoting rc into stable (`bin/repo advance --from rc --to stable`)
-- the release pair (`omarchy`, `omarchy-settings`) builds for `rc` from the standing `rc`
-  branch; the dev pair (`omarchy-dev`, `omarchy-settings-dev`) is pinned to `edge`
+- the release pair (`omarchy`, `omarchy-settings`) is marked `"pinned": true`: its version
+  is set per release on the standing `rc` branch, so only a build from that branch's worktree
+  (`OMARCHY_RC_PINS=1`, which `omarchy-release rc` sets) may build it for rc — master's
+  shipped pins can never overwrite an in-flight RC. The dev pair
+  (`omarchy-dev`, `omarchy-settings-dev`) is pinned to `edge`
 - AUR sync behavior is controlled by `source`, `sync`, `aur`, patches, and hooks in `.omarchy/`
 - packages can opt out of unscoped builds with `skip_build`; explicit `--package` builds remain available
 - packages that follow a vendor release feed instead of the AUR carry an `.omarchy/upstream.sh` hook
@@ -586,7 +591,8 @@ Fields:
 - `sync`: optional for AUR packages; defaults to `true`. Set `false` for AUR-origin packages that Omarchy maintains manually.
 - `aur`: optional AUR package name when it differs from the local package directory, usually for split packages.
 - `release_ring`: optional. `fast` means the package is built directly for stable as well as edge, with the artifacts replicated into rc for parity. Packages without a ring build in edge and reach stable through the pipeline (`bin/repo advance`).
-- `channels`: optional array pinning where the package lives (`edge`, `rc`, `stable`). With the key present the package builds in each listed channel except `stable` (stable is only fed by promotion), and `bin/repo advance` refuses to carry it anywhere it isn't a member. Without the key a package is a member of every channel and follows the default build rules above.
+- `channels`: optional array bounding where the package may be built (`edge`, `rc`, `stable`). Without the key a package is a member of every channel and follows the default build rules above; `bin/repo advance` refuses to carry a package anywhere it isn't a member.
+- `pinned`: optional boolean. A pinned package's version is set per release by `omarchy-release` on the `rc` branch, so it is never built for stable (promotion only) and is built for rc only from that branch's worktree (`OMARCHY_RC_PINS=1`). Used by `omarchy` and `omarchy-settings`.
 - `skip_build`: optional boolean; defaults to `false`. Set `true` to exclude a package from scheduled version checks and unscoped builds. The package can still be built explicitly with `bin/repo release --package <name>`.
 - `pkgrel`: optional Omarchy pkgrel suffix for a version-pinned rebuild bump. This emits `<aur pkgrel>.<suffix>` instead of replacing AUR's pkgrel. `offset` can be used only when preserving monotonic upgrades from old absolute pkgrel bumps. The metadata is removed automatically when AUR sync changes `pkgver`; the current package version is read from the checked-in PKGBUILD, so the version is not duplicated in JSON.
 - `rebuild_on`: optional array of package names this package links against closely enough that it must be rebuilt when they change, independent of its own source. Read by `bin/sync-rebuilds`.
@@ -596,8 +602,8 @@ Fields:
 ### Build Matrix
 
 - **Edge unscoped builds** (`--mirror edge`): packages in `pkgbuilds/*` unless `"skip_build": true` or `channels` excludes edge
-- **Rc unscoped builds** (`--mirror rc`): packages whose `channels` include `rc` (the release pair, built from the `rc` branch worktree)
-- **Stable unscoped builds** (`--mirror stable`): packages with `"release_ring": "fast"` unless `"skip_build": true`; their artifacts replicate to rc in the same run
+- **Rc unscoped builds** (`--mirror rc`): `"release_ring": "fast"` packages, built natively in the rc image. The pinned release pair joins them only when `OMARCHY_RC_PINS=1` (the `rc` branch worktree, set by `omarchy-release rc`)
+- **Stable unscoped builds** (`--mirror stable`): packages with `"release_ring": "fast"` unless `"skip_build": true`
 - **Explicit builds** (`--package <name>`): the selected package, including packages with `"skip_build": true`, subject to mirror eligibility
 - **Channel moves** (`bin/repo advance`): copies current packages + signatures forward through edge → rc → stable, never rewriting a published filename
 
@@ -741,7 +747,7 @@ reaches the mirror in minutes rather than hours:
 
 1. **check-versions** (`*:0/5`): Pulls latest from git, compares PKGBUILD versions to published versions, creates state files if builds are needed
 2. **auto-release-edge** (`*:1/5`): If a state file exists, builds all edge packages that need updates
-3. **auto-release-rc** (`*:2/5`): Builds the rc channel from the `rc` branch worktree (`/root/omarchy-pkgs-rc`), publishing into the shared channel tree. It runs from the main checkout and creates that worktree on demand, so a host with no rc branch yet is a no-op rather than a failing unit. The orchestrator also triggers this immediately over ssh when cutting an RC
+3. **auto-release-rc** (`*:2/5`): Builds fast-ring packages for rc, from the main checkout like the other two — natively in the rc image, not copied from another channel. The pinned release pair is built separately by `omarchy-release rc` in the `rc` branch worktree
 4. **auto-release-stable** (`*:3/5`): If a state file exists, builds `release_ring=fast` packages for stable and replicates them to rc
 
 That cadence is only safe because of three guards:
diff --git a/bin/advance-channel b/bin/advance-channel
index 50aff09..5581a8e 100755
--- a/bin/advance-channel
+++ b/bin/advance-channel
@@ -202,11 +202,6 @@ package_eligible() {
 
   if [[ "$FAST_RING_ONLY" == true ]]; then
     package_is_fast_ring "$pkgdir" || return 1
-  elif [[ "$FROM" == "edge" && "$TO" == "rc" ]]; then
-    # Fast-ring packages reach rc by replication of the STABLE build (same
-    # bytes stable users get). Carrying the independently built edge artifact
-    # forward would race it under the same filename.
-    package_is_fast_ring "$pkgdir" && return 1
   fi
 
   # The bootstrap seeds an empty rc from stable, so parity is the whole point:
diff --git a/bin/auto-release-rc b/bin/auto-release-rc
deleted file mode 100755
index 07dfc31..0000000
--- a/bin/auto-release-rc
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/bash
-# Scheduled entry point for the rc channel.
-#
-# The rc channel builds from the standing `rc` branch in its own worktree, but
-# that branch does not exist until the first RC is cut — and a host set up
-# before then has no worktree either. This runs from the MAIN checkout, which
-# always exists, and makes both conditions non-events: no branch means nothing
-# to build, and a missing worktree is created on demand rather than failing
-# the unit every five minutes.
-
-set -e
-
-BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
-source "$BUILD_ROOT/helpers/message-helpers.sh"
-
-RC_WORKTREE="${OMARCHY_RC_WORKTREE:-/root/omarchy-pkgs-rc}"
-STATE_DIR="${OMARCHY_STATE_DIR:-/root/.state}"
-
-# Nothing queued: the common case. Exit before touching the network.
-[[ -f "$STATE_DIR/.sync-needed-rc" ]] || exit 0
-
-git -C "$BUILD_ROOT" fetch --quiet origin rc 2>/dev/null || true
-
-if ! git -C "$BUILD_ROOT" show-ref --verify --quiet refs/remotes/origin/rc; then
-  print_info "No rc branch yet — nothing to build (the first RC cut creates it)"
-  exit 0
-fi
-
-if [[ ! -d "$RC_WORKTREE" ]]; then
-  print_info "Creating rc worktree at $RC_WORKTREE..."
-  if git -C "$BUILD_ROOT" show-ref --verify --quiet refs/heads/rc; then
-    git -C "$BUILD_ROOT" worktree add "$RC_WORKTREE" rc
-  else
-    git -C "$BUILD_ROOT" worktree add --track -b rc "$RC_WORKTREE" origin/rc
-  fi
-fi
-
-# The rc branch is rebuilt as master + pins for each cut and force-pushed, so
-# this follows with a hard reset rather than a fast-forward pull.
-git -C "$RC_WORKTREE" fetch origin rc
-git -C "$RC_WORKTREE" reset --hard origin/rc
-
-exec "$RC_WORKTREE/bin/auto-release" rc
diff --git a/bin/check-versions b/bin/check-versions
index 0d12005..fe76583 100755
--- a/bin/check-versions
+++ b/bin/check-versions
@@ -179,6 +179,7 @@ check_mirror() {
 }
 
 check_mirror edge
+check_mirror rc
 check_mirror stable
 
 print_success "Version check complete!"
diff --git a/bin/omarchy-release b/bin/omarchy-release
index eb9df6f..9a7e94e 100755
--- a/bin/omarchy-release
+++ b/bin/omarchy-release
@@ -225,8 +225,12 @@ print_no_host_help() { # print_no_host_help <what> <script>
   echo "$2" >&2
 }
 
-# Creates the rc worktree on first use (a host set up before the rc branch
-# existed has none), then syncs it and kicks the service.
+# Builds the pinned release pair for the rc channel from the rc branch's own
+# worktree, creating it on first use. OMARCHY_RC_PINS marks this as the one
+# build allowed to set those packages' rc versions; OMARCHY_REPO_ROOT points
+# the worktree at the primary checkout's channel tree so all three channels
+# stay in one place. Fast-ring packages are not built here — the scheduled rc
+# release covers those from master.
 RC_TRIGGER_SCRIPT='
 set -e
 git -C /root/omarchy-pkgs fetch origin rc
@@ -236,24 +240,21 @@ if [ ! -d /root/omarchy-pkgs-rc ]; then
 fi
 git -C /root/omarchy-pkgs-rc fetch origin rc
 git -C /root/omarchy-pkgs-rc reset --hard origin/rc
-mkdir -p /root/.state
-touch /root/.state/.sync-needed-rc
-systemctl start --no-block omarchy-auto-release-rc.service
+cd /root/omarchy-pkgs-rc
+OMARCHY_RC_PINS=1 OMARCHY_REPO_ROOT=/root/omarchy-pkgs/pkgs.omarchy.org \
+  bin/repo release --mirror rc --package omarchy omarchy-settings --skip-prod-check
 '
 
-# An explicitly configured destination outranks the local-host inference: a
-# workstation that once ran a full local release carries the published-db
-# marker too, and its .repo-host must still win.
 trigger_rc_build() {
   local host
   if host=$(repo_host); then
-    print_info "Triggering rc build on $host..."
-    ssh "$host" "$RC_TRIGGER_SCRIPT"
+    print_info "Building the RC on $host (this takes a while)..."
+    ssh "$host" "source /root/.omarchy/build-credentials 2>/dev/null; $RC_TRIGGER_SCRIPT"
   elif on_repo_host; then
-    print_info "Triggering rc build locally (this is the build host)..."
+    print_info "Building the RC locally (this is the build host)..."
     bash -c "$RC_TRIGGER_SCRIPT"
   else
-    print_no_host_help "build the rc channel" "$RC_TRIGGER_SCRIPT"
+    print_no_host_help "build the release candidate" "$RC_TRIGGER_SCRIPT"
     return 1
   fi
 }
diff --git a/bin/release b/bin/release
index 10946aa..23e8cfc 100755
--- a/bin/release
+++ b/bin/release
@@ -218,25 +218,5 @@ else
   notify_info "Release ran with nothing to publish: $MIRROR" "$summary"
 fi
 
-# Step 7 (stable only): fast-ring packages publish to rc and stable together,
-# so rc never falls behind what stable users actually run. Skipped until the
-# rc channel has been bootstrapped.
-if [[ "$MIRROR" == "stable" ]]; then
-  echo ""
-  if [[ -f "$REPO_ROOT/rc/$ARCH/omarchy.db.tar.zst" ]]; then
-    print_info "Step 7: Replicating fast-ring packages to rc (parity)..."
-    REPLICATE_ARGS=(--from stable --to rc --fast-ring --arch "$ARCH")
-    [[ -n "$SYNC_REMOTE" ]] && REPLICATE_ARGS+=(--sync-remote "$SYNC_REMOTE")
-    [[ "$SKIP_PROD_CHECK" == true ]] && REPLICATE_ARGS+=(--skip-prod-check)
-    "$BUILD_ROOT/bin/advance-channel" "${REPLICATE_ARGS[@]}" || {
-      print_error "Fast-ring replication to rc failed"
-      notify_error "Release failed: rc parity replication failed" "$RELEASE_CONTEXT"
-      exit 1
-    }
-  else
-    print_info "rc channel not bootstrapped; skipping fast-ring replication"
-  fi
-fi
-
 echo ""
 print_success "Release workflow completed successfully!"
diff --git a/helpers/package-metadata.sh b/helpers/package-metadata.sh
index bd44abe..c121b46 100644
--- a/helpers/package-metadata.sh
+++ b/helpers/package-metadata.sh
@@ -162,6 +162,18 @@ package_in_channel() {
   package_channels "$pkgdir" | grep -qx "$channel"
 }
 
+# A pinned package's version is set per release by the orchestrator on the rc
+# branch, not by whatever the current checkout happens to say. Only a build
+# running from that branch's worktree (OMARCHY_RC_PINS=1) may build it for rc;
+# otherwise master's shipped pins would try to overwrite an in-flight RC with
+# an older version.
+package_is_pinned() {
+  local pkgdir="$1" metadata
+  metadata=$(metadata_file_for_dir "$pkgdir")
+  [[ -f "$metadata" ]] || return 1
+  [[ "$(jq -r 'if has("pinned") then .pinned else false end' "$metadata")" == "true" ]]
+}
+
 package_builds_for_mirror() {
   local pkgdir="$1"
   local mirror="$2"
@@ -169,28 +181,26 @@ package_builds_for_mirror() {
   package_has_pkgbuild "$pkgdir" || return 1
   package_has_metadata "$pkgdir" || return 1
 
-  # An explicit `channels` key pins where a package is BUILT: it builds in
-  # each listed channel except stable, which is only ever fed by promotion.
-  # Without the key, the defaults hold: everything builds for edge, and
-  # fast-ring packages also build directly for stable (bin/release then
-  # replicates those artifacts into rc to keep rc and stable in parity).
-  if package_has_channels "$pkgdir"; then
-    case "$mirror" in
-      edge | rc)
-        package_in_channel "$pkgdir" "$mirror"
-        return
-        ;;
-      *)
-        return 1
-        ;;
-    esac
+  # An explicit `channels` key is the outer bound on where a package may be
+  # built at all.
+  if package_has_channels "$pkgdir" && ! package_in_channel "$pkgdir" "$mirror"; then
+    return 1
   fi
 
   case "$mirror" in
     edge)
       return 0
       ;;
+    rc)
+      # Fast-ring packages build for rc natively rather than being copied from
+      # stable: the rc channel's Arch base can be sitting anywhere between
+      # stable's snapshot and edge's, so an artifact linked against stable's
+      # libraries is not necessarily correct for rc.
+      package_is_pinned "$pkgdir" && { [[ -n "${OMARCHY_RC_PINS:-}" ]]; return; }
+      package_is_fast_ring "$pkgdir"
+      ;;
     stable)
+      package_is_pinned "$pkgdir" && return 1
       package_is_fast_ring "$pkgdir"
       ;;
     *)
@@ -412,6 +422,11 @@ validate_package_metadata() {
     *) echo "invalid release_ring for $(basename "$pkgdir"): $ring"; return 1 ;;
   esac
 
+  if ! jq -e 'if has("pinned") | not then true else (.pinned | type) == "boolean" end' "$metadata" >/dev/null; then
+    echo "invalid pinned for $(basename "$pkgdir"): must be boolean"
+    return 1
+  fi
+
   if ! jq -e '
     if has("channels") | not then true
     else .channels | type == "array" and length > 0
diff --git a/pkgbuilds/omarchy-settings/.omarchy/package.json b/pkgbuilds/omarchy-settings/.omarchy/package.json
index 51920e3..1036cee 100644
--- a/pkgbuilds/omarchy-settings/.omarchy/package.json
+++ b/pkgbuilds/omarchy-settings/.omarchy/package.json
@@ -1 +1,5 @@
-{ "source": "local", "channels": ["edge", "rc", "stable"] }
+{
+  "source": "local",
+  "channels": ["edge", "rc", "stable"],
+  "pinned": true
+}
diff --git a/pkgbuilds/omarchy/.omarchy/package.json b/pkgbuilds/omarchy/.omarchy/package.json
index 51920e3..1036cee 100644
--- a/pkgbuilds/omarchy/.omarchy/package.json
+++ b/pkgbuilds/omarchy/.omarchy/package.json
@@ -1 +1,5 @@
-{ "source": "local", "channels": ["edge", "rc", "stable"] }
+{
+  "source": "local",
+  "channels": ["edge", "rc", "stable"],
+  "pinned": true
+}
diff --git a/systemd/omarchy-auto-release-rc.service b/systemd/omarchy-auto-release-rc.service
index 86bb943..0078b3d 100644
--- a/systemd/omarchy-auto-release-rc.service
+++ b/systemd/omarchy-auto-release-rc.service
@@ -5,13 +5,13 @@ Wants=network-online.target
 
 [Service]
 Type=oneshot
-# Runs from the main checkout: bin/auto-release-rc creates and syncs the rc
-# branch worktree itself, so a host with no rc branch yet is a no-op instead
-# of a unit that fails every five minutes. Builds happen in the worktree but
-# publish into the primary checkout's channel tree via OMARCHY_REPO_ROOT.
-ExecStart=/bin/bash -c 'source /root/.omarchy/build-credentials && /root/omarchy-pkgs/bin/auto-release-rc'
+# Runs from the main checkout, exactly like edge and stable: this builds the
+# packages the version check discovers for rc (fast-ring), natively in the rc
+# image against the rc mirror. The pinned release pair is NOT built here —
+# its version comes from the rc branch, and omarchy-release builds it in that
+# branch's worktree with OMARCHY_RC_PINS=1.
+ExecStart=/bin/bash -c 'source /root/.omarchy/build-credentials && /root/omarchy-pkgs/bin/auto-release rc'
 Environment=OMARCHY_STATE_DIR=/root/.state
-Environment=OMARCHY_REPO_ROOT=/root/omarchy-pkgs/pkgs.omarchy.org
 TimeoutStartSec=7200
 
 [Install]