diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 7196360..df13d2a 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -75,6 +75,8 @@ jobs:
           ref: ${{ needs.release-please.outputs.tag_name || inputs.package_tag }}
 
       - name: Build the package
+        env:
+          TAG: ${{ needs.release-please.outputs.tag_name || inputs.package_tag }}
         # -Syu, not -Sy: a partial upgrade can link the fresh python against a
         # glibc this image does not have, and it reads as a build bug.
         # github-cli because `gh` lives on the RUNNER, not inside the container.
@@ -82,6 +84,11 @@ jobs:
         # --nodeps because `depends` is a runtime contract for the target machine.
         run: |
           pacman -Syu --noconfirm --needed git python github-cli
+          # The tag is the truth. Rewriting pkgver here means the package can
+          # never carry a version the release does not, and release-please needs
+          # no extra-files entry to keep them in step.
+          sed -i "s/^pkgver=.*/pkgver=${TAG#v}/" PKGBUILD
+          grep -q "^pkgver=${TAG#v}$" PKGBUILD
           useradd -m build && chown -R build:build .
           su build -c 'makepkg -f --nodeps --noconfirm'
           ls -l ./*.pkg.tar.*
diff --git a/PKGBUILD b/PKGBUILD
index 84728b7..16774a8 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -4,7 +4,12 @@
 # are kept honest by tests/test_pkgbuild.py, which fails if either grows a file
 # the other does not carry.
 pkgname=macarchy-touchbar
-pkgver=0.4.0 # x-release-please-version
+# Rewritten from the tag by the packaging job before makepkg runs, so the built
+# package can never disagree with the release it is attached to. The value here
+# is the fallback for a manual `makepkg` from a checkout; release-please used to
+# maintain it through extra-files, which made it fail to build a release PR at all
+# ("unexpected token '(' at 6:32"). One less coupling.
+pkgver=0.4.0
 pkgrel=1
 pkgdesc="A Touch Bar daemon for MacBooks on Linux — draws every pixel over DRM, follows the focused app, takes modules"
 arch=('any')
diff --git a/release-please-config.json b/release-please-config.json
index ae0c7cc..0a52ab3 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -7,10 +7,7 @@
       "release-type": "simple",
       "package-name": "macarchy-touchbar",
       "include-component-in-tag": false,
-      "changelog-path": "CHANGELOG.md",
-      "extra-files": [
-        "PKGBUILD"
-      ]
+      "changelog-path": "CHANGELOG.md"
     }
   }
 }
diff --git a/tests/test_pkgbuild.py b/tests/test_pkgbuild.py
index e0fe799..7b305fe 100644
--- a/tests/test_pkgbuild.py
+++ b/tests/test_pkgbuild.py
@@ -80,12 +80,16 @@ def test_the_package_is_arch_independent():
     assert "arch=('any')" in PKG_CODE
 
 
-def test_pkgver_is_maintained_by_release_please():
-    # Without the marker, release-please stops bumping pkgver and a release
-    # ships a package whose version is the previous tag's — silently.
-    assert "x-release-please-version" in PKG_CODE
+def test_pkgver_comes_from_the_tag_at_build_time():
+    # release-please's extra-files updater could not parse this file and failed
+    # to build a release PR at all. The packaging job rewrites pkgver from the
+    # tag instead, which is stricter: the package cannot carry a version the
+    # release does not, and there is no config coupling left to break.
+    wf = (ROOT / ".github" / "workflows" / "release-please.yml").read_text()
+    assert 's/^pkgver=.*/pkgver=${TAG#v}/' in wf
+    assert 'grep -q "^pkgver=${TAG#v}$" PKGBUILD' in wf, "the rewrite must be checked, not hoped"
     cfg = json.loads((ROOT / "release-please-config.json").read_text())
-    assert "PKGBUILD" in cfg["packages"]["."]["extra-files"]
+    assert "extra-files" not in cfg["packages"]["."]
 
 
 def test_the_codepoints_are_shipped_and_not_skipped():