diff --git a/.github/workflows/upstream-desktop-sync.yml b/.github/workflows/upstream-desktop-sync.yml
index 92bbb644692..19d2054e97d 100644
--- a/.github/workflows/upstream-desktop-sync.yml
+++ b/.github/workflows/upstream-desktop-sync.yml
@@ -70,7 +70,7 @@ jobs:
           if [[ "$(printf '%s\n%s\n' "$current" "$target" | sort -V | tail -n 1)" != "$target" ]]; then
             echo "::error::refusing to downgrade from $current to $target"
             exit 1
-          }
+          fi
           echo "current=$current" >> "$GITHUB_OUTPUT"
           echo "current_sha=$current_sha" >> "$GITHUB_OUTPUT"
           echo "target=$target" >> "$GITHUB_OUTPUT"
diff --git a/scripts/test-upstream-desktop-sync-contract.sh b/scripts/test-upstream-desktop-sync-contract.sh
index 113de3d7372..3c8d2a26ec9 100755
--- a/scripts/test-upstream-desktop-sync-contract.sh
+++ b/scripts/test-upstream-desktop-sync-contract.sh
@@ -36,6 +36,19 @@ grep -Fq 'gh pr create' "$workflow"
 grep -Fq 'gh issue create' "$workflow"
 grep -Fq 'UPSTREAM_SYNC_TOKEN' "$workflow"
 
+resolve_script="$tmp/resolve-released-upstream-baseline.sh"
+awk '
+  /^      - name: Resolve released upstream baseline$/ { found = 1; next }
+  found && /^        run: \|$/ { in_run = 1; next }
+  in_run && /^      - name:/ { exit }
+  in_run { sub(/^          /, ""); print }
+' "$workflow" >"$resolve_script"
+[[ -s "$resolve_script" ]] || {
+  echo "could not extract upstream baseline resolver from workflow" >&2
+  exit 1
+}
+bash -n "$resolve_script"
+
 if grep -Eq 'gh pr merge|git push[^\n]*origin[^\n]*main' "$workflow"; then
   echo "upstream sync workflow may merge or push directly to main" >&2
   exit 1