diff --git a/bazel/tools.MODULE.bazel b/bazel/tools.MODULE.bazel
index c4b19e2c..14e65202 100644
--- a/bazel/tools.MODULE.bazel
+++ b/bazel/tools.MODULE.bazel
@@ -38,11 +38,18 @@ http_file(
 
 # DB-IP's free IP-to-country table (CC BY 4.0; muchq.com/stats carries the
 # attribution), bundled into the stats image (#1467). DB-IP publishes a new
-# file each month under a dated URL and keeps the old ones up, so a refresh
-# is a pin bump here and nothing on the host.
+# file each month under a dated URL, so a refresh is a pin bump here and
+# nothing on the host: download the month's file, upload it as a release
+# asset named for the month (`gh release create dbip-country-lite-YYYY-MM
+# <file> --target main`), and replace the month, the sha256, and both URLs.
+# The release is the fallback (#1478): Bazel tries the URLs in order, and
+# the pin keeps both honest.
 http_file(
     name = "dbip_country_lite",
     downloaded_file_path = "dbip-country-lite.csv.gz",
     sha256 = "a32bb3c384bd3de60ad9024596aa5b395a6dd5beaa27a7223407cc2edc681d0b",
-    urls = ["https://download.db-ip.com/free/dbip-country-lite-2026-09.csv.gz"],
+    urls = [
+        "https://download.db-ip.com/free/dbip-country-lite-2026-09.csv.gz",
+        "https://github.com/muchq/MoonBase/releases/download/dbip-country-lite-2026-09/dbip-country-lite-2026-09.csv.gz",
+    ],
 )
diff --git a/domains/platform/apis/stats/README.md b/domains/platform/apis/stats/README.md
index 0a01a262..15a0f7fb 100644
--- a/domains/platform/apis/stats/README.md
+++ b/domains/platform/apis/stats/README.md
@@ -62,9 +62,10 @@ and the two-letter code, with request, 403, and probe counts — where the
 scrapers, bots, and scanners come from. The database is DB-IP's free
 country CSV (CC BY 4.0; muchq.com's stats page carries the attribution),
 pinned by URL and sha256 as `@dbip_country_lite` in
-`bazel/tools.MODULE.bazel` and bundled into the image at
-`/geo/dbip-country-lite.csv.gz`; a new month is a pin bump, nothing on
-the host. The service loads it at boot into a sorted range table and
+`bazel/tools.MODULE.bazel` — DB-IP's own URL first, a release asset on
+this repository as the fallback — and bundled into the image at
+`/geo/dbip-country-lite.csv.gz`; a new month is a pin bump (the steps are
+on the pin), nothing on the host. The service loads it at boot into a sorted range table and
 binary-searches it, no library. Overlapping rows lose to the range they
 sit in, and the `ZZ` rows DB-IP uses for reserved and private space are
 not placements. An address outside every range files under `--`, and so