diff --git a/.github/workflows/release-verify.yml b/.github/workflows/release-verify.yml
index 4a7b9e2e29..438649d30e 100644
--- a/.github/workflows/release-verify.yml
+++ b/.github/workflows/release-verify.yml
@@ -247,8 +247,8 @@ jobs:
           # dependencies; never restore installed executables from cargo/bin.
           cache-workspace-crates: false
           cache-bin: false
-          # Manual candidate refs may read the cache, but only a successful
-          # master push verifying its own commit can populate the shared cache.
+          # The step guard also restricts restores. Save only after a successful
+          # master-push verification of that push's exact commit.
           save-if: ${{ github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
 
       - name: Install dependencies