diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 217858f53..31f9a5dd4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -116,6 +116,9 @@ jobs:
           # CHANGELOG.md without the version's section.
           notes=$(mktemp)
           trap 'rm -f "$notes"' EXIT
+          # checkout leaves the pushed tag pointing at the commit; fetch the
+          # annotated tag object so its paragraph reaches the notes
+          git fetch --force origin "+refs/tags/$tag:refs/tags/$tag"
           tools/release-notes.sh "$tag" > "$notes"
 
           gh release create "$tag" \
diff --git a/tools/release-notes.sh b/tools/release-notes.sh
index 93fdf4b7d..fe4e4ee6a 100755
--- a/tools/release-notes.sh
+++ b/tools/release-notes.sh
@@ -38,9 +38,15 @@ section=$(awk -v v="## $ver" -v pfx="## ${ver%.*}." '
 entries=$(printf '%s\n' "$section" | grep -c '^- ' || true)
 
 # The annotated tag's body, the paragraph written when the release was cut.
-# A lightweight tag has none, and the notes do without.
-summary=$(git tag -l --format='%(contents:body)' "$tag" 2>/dev/null |
-          sed '/^-----BEGIN PGP/,$d' | sed -e :a -e '/^\n*$/{$d;N;ba' -e '}')
+# A lightweight tag has none, and the notes do without.  Read it only from a
+# tag object: on a ref to a commit, %(contents:body) is the commit's message,
+# and actions/checkout leaves the pushed tag as exactly such a ref, so beta7's
+# first notes carried the squash commit's body.
+summary=""
+if [ "$(git for-each-ref --format='%(objecttype)' "refs/tags/$tag")" = tag ]; then
+    summary=$(git tag -l --format='%(contents:body)' "$tag" 2>/dev/null |
+              sed '/^-----BEGIN PGP/,$d' | sed -e :a -e '/^\n*$/{$d;N;ba' -e '}')
+fi
 
 # name<TAB>url<TAB>why; a malformed line fails the render rather than
 # publishing a broken bullet.