diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index f06ebd9..3f2e847 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -220,7 +220,9 @@ jobs:
   gitea-release:
     name: Cria a release no Gitea
     needs: [publish, prepare]
-    if: startsWith(gitea.ref, 'refs/tags/v')
+    # Explicit, like publish: the build job upstream is skipped when the images
+    # are reused, and the implicit success() would then skip this job too.
+    if: ${{ !cancelled() && needs.publish.result == 'success' && startsWith(gitea.ref, 'refs/tags/v') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -233,21 +235,7 @@ jobs:
           API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
           NAMESPACE: ${{ env.REGISTRY }}/${{ needs.prepare.outputs.namespace }}
         run: |
-          prev=$(git describe --tags --abbrev=0 "$TAG^" 2>/dev/null || true)
-          range=${prev:+$prev..}$TAG
-          {
-            echo "## Imagens"
-            echo
-            echo '```'
-            for s in protocols auth storage webmail migrations rspamd; do
-              echo "$NAMESPACE/$s:${TAG#v}"
-            done
-            echo '```'
-            echo
-            echo "## Mudanças${prev:+ desde $prev}"
-            echo
-            git log --no-merges --format='- %s (%h)' "$range"
-          } > notes.md
+          scripts/release-notes.sh "$TAG" "$NAMESPACE" > notes.md
           pre=false; case "$TAG" in *-*) pre=true ;; esac
           jq -n --arg tag "$TAG" --arg name "LambdaMail ${TAG#v}" --rawfile body notes.md --argjson pre "$pre" \
             '{tag_name:$tag, name:$name, body:$body, prerelease:$pre}' > release.json
diff --git a/scripts/release-notes.sh b/scripts/release-notes.sh
new file mode 100755
index 0000000..259446d
--- /dev/null
+++ b/scripts/release-notes.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Prints the release notes for a tag: the images it publishes, then the matching
+# section of CHANGELOG.md (the commit log since the previous tag if the changelog
+# has no section for that version).
+#
+#   scripts/release-notes.sh v1.2.3 git.example.com/owner/project
+set -euo pipefail
+
+tag=${1:?usage: release-notes.sh <tag> <image-namespace>}
+namespace=${2:?usage: release-notes.sh <tag> <image-namespace>}
+version=${tag#v}
+
+echo "## Images"
+echo
+echo '```'
+for service in protocols auth storage webmail migrations rspamd; do
+  echo "$namespace/$service:$version"
+done
+echo '```'
+echo
+
+section=""
+if [ -f CHANGELOG.md ]; then
+  section=$(awk -v head="## [$version]" '
+    index($0, head) == 1 { found = 1; next }
+    found && /^## \[/ { exit }
+    found && /^\[[^]]+\]: / { next }
+    found { print }
+  ' CHANGELOG.md)
+fi
+
+if [ -n "$(printf '%s' "$section" | tr -d '[:space:]')" ]; then
+  printf '%s\n' "$section"
+else
+  previous=$(git describe --tags --abbrev=0 "$tag^" 2>/dev/null || true)
+  echo "## Changes${previous:+ since $previous}"
+  echo
+  git log --no-merges --format='- %s (%h)' "${previous:+$previous..}$tag"
+fi