diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml
index 6e86b633d..4cf17c151 100644
--- a/.github/workflows/_build.yml
+++ b/.github/workflows/_build.yml
@@ -106,11 +106,13 @@ jobs:
           set -euo pipefail
           PACKAGING=$(dpkg-parsechangelog -SVersion)
           UPSTREAM=${PACKAGING%-*}
-          # Upstream version (and orig tarball) stays shared.
+          # Upstream version and orig tarball stay shared across suites.
+          # The asset filename omits the suffix. The suite token already
+          # disambiguates, so it adds nothing while version-suffix stays a
+          # static per-suite constant (no bookworm-only ~bpo12+N rebuilds).
+          PACKAGING_FNAME="${PACKAGING}"
+          # The .deb keeps the real ~bpo12+1, which is what apt sorts on.
           PACKAGING="${PACKAGING}${{ inputs.version-suffix }}"
-          # GitHub rewrites ~ to . in release uploads. Use + to
-          # keep SHA256SUMS valid.
-          PACKAGING_FNAME="${PACKAGING//\~/+}"
           echo "packaging=${PACKAGING}"             >> "$GITHUB_OUTPUT"
           echo "packaging-fname=${PACKAGING_FNAME}" >> "$GITHUB_OUTPUT"
           echo "upstream=${UPSTREAM}"               >> "$GITHUB_OUTPUT"
@@ -148,16 +150,29 @@ jobs:
           PKG="${{ inputs.package-name }}"
           UPSTREAM="${{ steps.version.outputs.upstream }}"
           SUFFIX="${{ inputs.version-suffix }}"
+          PACKAGING="${{ steps.version.outputs.packaging }}"
           cd "${GITHUB_WORKSPACE}/${PKG}-${UPSTREAM}"
-          # sbuild requires an attribution because appending a
-          # suffix edits the changelog copy.
-          MAINT=$(dpkg-parsechangelog -SMaintainer)
+          # A suffixed suite (bookworm's ~bpo12+1) is a real backport, so
+          # record it as a source-version changelog entry and build normally.
+          # Avoid sbuild --append-to-version, which implies --no-arch-all and
+          # drops arch:all packages (Debian #911399).
+          if [ -n "$SUFFIX" ]; then
+            MAINT=$(dpkg-parsechangelog -SMaintainer)
+            DEBFULLNAME="${MAINT% <*}"
+            DEBEMAIL="${MAINT#*<}"
+            DEBEMAIL="${DEBEMAIL%>}"
+            export DEBFULLNAME DEBEMAIL
+            # ~ sorts below the trixie revision, so dch needs the override.
+            dch --force-bad-version --force-distribution \
+              --newversion "${PACKAGING}" \
+              --distribution "${{ inputs.suite }}" \
+              "Rebuild for ${{ inputs.suite }}."
+          fi
           sbuild \
             --verbose \
             -d "${{ inputs.suite }}" \
             --arch=${{ inputs.arch }} \
             --profiles="${{ inputs.profiles }}" \
-            ${SUFFIX:+--append-to-version="${SUFFIX}" --maintainer="${MAINT}"} \
             --extra-repository="deb http://archive.raspberrypi.com/debian/ ${{ inputs.suite }} main" \
             --extra-repository-key="${GITHUB_WORKSPACE}/recipe/.github/keys/raspberrypi-archive-keyring.gpg" \
             --no-clean-source
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0186ee07c..799c712f0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -190,9 +190,14 @@ jobs:
           RPI_TAG="v${UPSTREAM%+krks*}"
           RPI_URL="https://github.com/raspberrypi/libcamera/releases/tag/${RPI_TAG//+/%2B}"
 
-          # Re-run on the same tag only refreshes assets, leaving
-          # the title, Pre-release flag and any manual notes intact.
+          # Re-run on an existing release refreshes its assets, leaving title,
+          # notes and the Pre-release flag intact. Clear the assets first then
+          # re-upload so a packaging rebuild (-1 -> -2) cannot leave the old
+          # revision's tarballs beside the new SHA256SUMS.
           if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release view "$TAG" --repo "$GITHUB_REPOSITORY" \
+              --json assets --jq '.assets[].name' \
+              | xargs -r -I{} gh release delete-asset "$TAG" {} --yes --repo "$GITHUB_REPOSITORY"
             gh release upload "$TAG" --repo "$GITHUB_REPOSITORY" \
               --clobber release-assets/*
             exit 0
diff --git a/debian/changelog b/debian/changelog
index 890f43221..10ee2468d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+libcamera (0.7.1+rpt20260429+krks1-3) trixie; urgency=medium
+
+  * Packaging-only rebuild to align the release tooling. No code changes.
+  * Build suffixed suites from a source-version backport changelog entry
+    instead of sbuild --append-to-version (Debian #911399).
+  * Drop the suffix from release asset filenames. The suite token already
+    distinguishes the build, so the + stand-in for ~ is redundant. The
+    .deb keeps ~bpo12+1 internally.
+
+ -- Danius Kalvaitis <danius@kurokesu.com>  Thu, 18 Jun 2026 21:55:00 +0300
+
 libcamera (0.7.1+rpt20260429+krks1-2) trixie; urgency=medium
 
   * Publish release artifacts to the source tag with skeleton release notes