diff --git a/scripts/create-release.sh b/scripts/create-release.sh
index ec4fbfa2..7bb3f094 100755
--- a/scripts/create-release.sh
+++ b/scripts/create-release.sh
@@ -158,6 +158,16 @@ cd "$PROJECT_ROOT/neode-ui"
 npm run build 2>&1 | tail -3
 cd "$PROJECT_ROOT"
 
+# npm run build wipes web/dist — fold AIUI straight back in. The OTA tarball
+# bakes it from demo/aiui independently, but build-iso-release.sh's
+# verify-artifacts guard checks web/dist/neode-ui/aiui and failed on two
+# consecutive releases (.127, .129) because this fold-in was manual.
+if [ -d "$PROJECT_ROOT/demo/aiui" ] && [ -f "$PROJECT_ROOT/demo/aiui/index.html" ]; then
+    rm -rf "$PROJECT_ROOT/web/dist/neode-ui/aiui"
+    cp -r "$PROJECT_ROOT/demo/aiui" "$PROJECT_ROOT/web/dist/neode-ui/aiui"
+    echo "  AIUI folded into web/dist from demo/aiui"
+fi
+
 # npm run build can silently no-op (vue-tsc EACCES burned us before) — a stale
 # dist would ship with a perfectly valid sha256. Require the freshly built
 # bundle to embed the version we just bumped to before it gets packaged.
@@ -264,12 +274,18 @@ fi
 echo "[7/8] Committing version bump..."
 git -C "$PROJECT_ROOT" add \
     core/archipelago/Cargo.toml \
+    core/Cargo.lock \
     neode-ui/package.json \
     neode-ui/package-lock.json \
+    neode-ui/public/catalog.json \
     CHANGELOG.md \
     releases/manifest.json \
     release-manifest.json \
     2>/dev/null || true
+# Cargo.lock (rewritten by the release build after the version bump) and
+# neode-ui/public/catalog.json (regenerated by the frontend build) belong in
+# THIS commit: leaving them dirty failed build-iso-release.sh's clean-tree
+# preflight on three consecutive releases (.127-.129, 2026-08-09/10).
 
 git -C "$PROJECT_ROOT" commit -m "chore: release v${VERSION}"