diff --git a/.github/workflows/ci-debian-image.yml b/.github/workflows/ci-debian-image.yml
index 1d7826f8..1635ed40 100644
--- a/.github/workflows/ci-debian-image.yml
+++ b/.github/workflows/ci-debian-image.yml
@@ -8,12 +8,13 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Release tag to publish to'
+        description: 'Release tag to publish to (a new -rN tag for a refresh; builds pin the one in tools/linuxfs/debian-image.env)'
         required: true
-        default: 'ci-debian-bullseye-r1'
-  push:
-    branches: [ci/cache-debian-image]
-    paths: ['.github/workflows/ci-debian-image.yml']
+        default: 'ci-debian-bullseye-r2'
+      replace:
+        description: 'Overwrite the asset if the release already has one (changes its checksum: re-pin it in debian-image.env)'
+        type: boolean
+        default: false
 
 permissions:
   contents: write
@@ -26,10 +27,16 @@ jobs:
       - name: Pull, save and publish
         env:
           GH_TOKEN: ${{ github.token }}
-          TAG: ${{ inputs.tag || 'ci-debian-bullseye-r1' }}
+          TAG: ${{ inputs.tag }}
+          REPLACE: ${{ inputs.replace }}
         run: |
           set -euo pipefail
           image=public.ecr.aws/docker/library/debian:bullseye
+          # A published image is pinned by checksum in the build; never replace one by accident.
+          if [ "$REPLACE" != true ] && gh release view "$TAG" -R "$GITHUB_REPOSITORY" --json assets -q '.assets[].name' 2>/dev/null | grep -qx debian-bullseye.tar.zst; then
+            echo "::error::$TAG already carries debian-bullseye.tar.zst; publish to a new tag, or set replace and re-pin tools/linuxfs/debian-image.env"
+            exit 1
+          fi
           for attempt in 1 2 3 4 5 6; do
             docker pull "$image" && break
             [ "$attempt" -lt 6 ] || { echo "::error::could not pull $image"; exit 1; }
diff --git a/tools/linuxfs/debian-image.env b/tools/linuxfs/debian-image.env
index 32243394..5532bfe1 100644
--- a/tools/linuxfs/debian-image.env
+++ b/tools/linuxfs/debian-image.env
@@ -5,4 +5,4 @@
 # refresh is only ever a new -rN release with the three lines below updated.
 DEBIAN_IMAGE_TAG=ci-debian-bullseye-r1
 DEBIAN_IMAGE_ASSET=debian-bullseye.tar.zst
-DEBIAN_IMAGE_SHA256=112aed723ccd2dc81d69a0ed8bb76b823ea28049fa56f72776f25d680bb36a00
+DEBIAN_IMAGE_SHA256=5ac13c6b0f2e3ab3e8acc8cadcd39ee453a51a72870645d592635e24bcb85459