diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c60b98da..9174fa15 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -196,28 +196,33 @@ jobs:
           upload-artifact: false
           upload-release-assets: false
 
+      # Before the Docker Hub steps. They describe an image that is already
+      # published, so a failure there must not cost the release its SBOM.
+      - name: Upload SBOM
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: sbom-${{ steps.meta.outputs.version }}
+          path: stackyard-${{ steps.meta.outputs.version }}.spdx.json
+          if-no-files-found: error
+
       # The page is only correct for an image that exists, so this runs after
-      # the push, and only for a stable tag: a release candidate must not
-      # rewrite the page describing what `latest` gives you.
+      # the push, and only for a stable tag: a pre-release must not rewrite the
+      # page describing what `latest` gives you.
       - name: Generate the Docker Hub description
         if: steps.registries.outputs.dockerhub == 'true' && steps.tag.outputs.prerelease == 'false'
         run: node scripts/dockerhub-description.js > dockerhub-description.md
 
+      # The description is not part of the release. A rejection here leaves the
+      # Docker Hub page describing an older version and nothing else.
       - name: Update the Docker Hub description
         if: steps.registries.outputs.dockerhub == 'true' && steps.tag.outputs.prerelease == 'false'
+        continue-on-error: true
         uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77 # v4.0.2
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
-          # The description API needs a token with write access; the pull-only
-          # token the push step is happy with returns 401 here.
+          # The description API needs a token permitted to edit repository
+          # metadata. A token that pushes images is not enough: it returns 403.
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           repository: ${{ vars.DOCKERHUB_NAMESPACE || vars.DOCKERHUB_USERNAME }}/stackyard
           readme-filepath: dockerhub-description.md
           short-description: A self-hosted homelab dashboard you actually want to look at.
-
-      - name: Upload SBOM
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: sbom-${{ steps.meta.outputs.version }}
-          path: stackyard-${{ steps.meta.outputs.version }}.spdx.json
-          if-no-files-found: error