diff --git a/.woodpecker.yml b/.woodpecker.yml
index bbe8de0..38d38d3 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -7,9 +7,7 @@ clone:
   git:
     image: woodpeckerci/plugin-git
     settings:
-      # 100, not 1: the release step renders `git log <serving>..<this>` for the
-      # release channel, and a depth-1 clone cannot name the commit it replaced.
-      depth: 100
+      depth: 1
 
 steps:
   test:
@@ -92,6 +90,12 @@ steps:
         done
         test -x usr/local/bin/courier || { echo "courier CLI not found in any layer of courierd@$$D"; exit 1; }
         mv usr/local/bin/courier ./courier; rm -rf usr manifest.json
+      # The clone is `--depth=1 --filter=tree:0` whatever `depth:` says (measured on
+      # pipeline 11: the plugin fetched depth 1 with depth: 100 set), and the notes are
+      # `git log <serving>..<this>`, which needs the commit it replaced. The repo is
+      # anonymously readable on Gitea, so deepen it here; 100 covers any gap between
+      # two deploys, and the fallbacks below say so if it does not.
+      - git fetch -q --deepen=100 origin 2>/dev/null || git fetch -q --unshallow origin 2>/dev/null || true
       - |
         set -- hush prod ${CI_COMMIT_SHA} \
           -image registry.threesix.ai/hush/api:${CI_COMMIT_SHA:0:8} -substrate k3s \