diff --git a/.github/workflows/build&release.yml b/.github/workflows/build&release.yml
index 1a8c14c0..97886754 100644
--- a/.github/workflows/build&release.yml
+++ b/.github/workflows/build&release.yml
@@ -72,17 +72,16 @@ jobs:
             echo "GHOEOF"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Check deploy intent
-        id: deploy_check
-        env:
-          TAG_MSG: ${{ steps.tag_info.outputs.tag_message }}
-        run: |
-          # NOTE: TAG_MSG is passed via env: (not ${{ }} inlined into the script)
-          # because the tag/commit message is multi-line and may contain shell
-          # metacharacters or command names (e.g. "deadcode"). Inlining it would
-          # let those lines execute as bash and abort the release job with exit
-          # 127. See build&release.yml history / v2.6.0-testnet post-mortem.
-          if printf '%s' "$TAG_MSG" | grep -qi '\[no-deploy\]'; then
+          # Deploy-intent check runs HERE (not in a separate step) because
+          # step-level `env:` values cannot safely carry the multi-line
+          # tag_message output — GHA rejects such workflows with a startup
+          # failure (0 jobs, run_attempt=1 completed instantly). Doing the
+          # check inline keeps the raw message inside a bash variable and
+          # only exports the single-line `draft` boolean to downstream steps.
+          # Prior implementation inlined the message via ${{ }} interpolation,
+          # which let commit-body tokens (e.g. "deadcode") execute as bash
+          # and killed v2.6.0-testnet with exit 127. See PR history.
+          if printf '%s' "$TAG_MESSAGE" | grep -qi '\[no-deploy\]'; then
             echo "draft=true" >> "$GITHUB_OUTPUT"
             echo "⚠️  [no-deploy] detected — release will be created as DRAFT"
           else
@@ -222,7 +221,7 @@ jobs:
         if: success() && steps.rel_check.outputs.exists != 'true'
         with:
           tag_name: ${{ steps.tag_info.outputs.tag_name }}
-          draft: ${{ steps.deploy_check.outputs.draft == 'true' }}
+          draft: ${{ steps.tag_info.outputs.draft == 'true' }}
           files: |
             release/${{ steps.vars.outputs.binary_name }}.tar.gz
             release/${{ steps.vars.outputs.binary_name }}
@@ -234,7 +233,7 @@ jobs:
         if: success() && steps.rel_check.outputs.exists == 'true'
         with:
           tag_name: ${{ steps.tag_info.outputs.tag_name }}
-          draft: ${{ steps.deploy_check.outputs.draft == 'true' }}
+          draft: ${{ steps.tag_info.outputs.draft == 'true' }}
           files: |
             release/${{ steps.vars.outputs.binary_name }}.tar.gz
             release/${{ steps.vars.outputs.binary_name }}