diff --git a/.github/workflows/nightly-release.yml b/.github/workflows/nightly-release.yml
index f844446..705f9be 100644
--- a/.github/workflows/nightly-release.yml
+++ b/.github/workflows/nightly-release.yml
@@ -207,6 +207,7 @@ jobs:
       version: ${{ steps.v.outputs.version }}
       dated_tag: ${{ steps.v.outputs.dated_tag }}
       title: ${{ steps.v.outputs.title }}
+      sha: ${{ steps.v.outputs.sha }}
     steps:
       - name: Require RELEASE_TOKEN (else no-op)
         id: token
@@ -238,12 +239,14 @@ jobs:
           BASE="$(crg)"                      # e.g. 0.31.2 (the current Cargo.toml version)
           DATE="$(date -u +%Y%m%d)"          # e.g. 20260714 (UTC)
           DATE_DASH="$(date -u +%Y-%m-%d)"   # e.g. 2026-07-14 (UTC, for the human title)
-          SHA="$(git rev-parse --short HEAD)"
+          SHORTSHA="$(git rev-parse --short HEAD)"
+          FULLSHA="$(git rev-parse HEAD)"
           # Semver PRERELEASE version — sorts BELOW the plain `X.Y.Z`, so a nightly never outranks
           # the stable release of the same version. Built at CI time; never committed.
-          echo "version=${BASE}-nightly.${DATE}.${SHA}" >> "$GITHUB_OUTPUT"
+          echo "version=${BASE}-nightly.${DATE}.${SHORTSHA}" >> "$GITHUB_OUTPUT"
           echo "dated_tag=nightly-${DATE}" >> "$GITHUB_OUTPUT"
-          echo "title=Nightly ${DATE_DASH} (${SHA})" >> "$GITHUB_OUTPUT"
+          echo "title=Nightly ${DATE_DASH} (${SHORTSHA})" >> "$GITHUB_OUTPUT"
+          echo "sha=${FULLSHA}" >> "$GITHUB_OUTPUT"
 
   # 2) build: the SAME reusable cross-OS build the stable release uses, stamped with the nightly
   #    version. Skipped (with the whole channel) when the token is absent.
@@ -254,7 +257,7 @@ jobs:
     uses: ./.github/workflows/build-binaries.yml
     with:
       version: ${{ needs.nightly-meta.outputs.version }}
-      ref: "" # build this run's commit (main HEAD)
+      ref: ${{ needs.nightly-meta.outputs.sha }}
 
   # 3) publish: attach the built binaries to a dated + rolling PRE-release, then prune old
   #    nightlies. Uses RELEASE_TOKEN for git tag + gh release operations (same identity as stable).
diff --git a/Cargo.lock b/Cargo.lock
index 1f075ae..ebf3248 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1966,7 +1966,7 @@ dependencies = [
 
 [[package]]
 name = "dig-node-service"
-version = "0.31.2"
+version = "0.31.3"
 dependencies = [
  "axum",
  "base64",
diff --git a/Cargo.toml b/Cargo.toml
index 2c0d617..a2c3831 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -27,11 +27,11 @@ members = [
 edition = "2021"
 # The RELEASE version of the repo's shipped artifact — the `dig-node` binary
 # (`dig-node-service`, which inherits this via `version.workspace = true`). This is
-# the version the tag-on-merge + version-increment CI reads from the ROOT manifest
-# (`[workspace.package].version`), so it MUST be set here for a release to fire
-# (§3.6). The library crates (dig-node-core/dig-runtime/dig-wallet) keep their own
-# independent versions — only the released binary tracks the workspace version.
-version = "0.31.2"
+# the version the nightly-release.yml stable channel + version-increment CI reads from
+# the ROOT manifest (`[workspace.package].version`), so it MUST be set here for a
+# release to fire (§3.6). The library crates (dig-node-core/dig-runtime/dig-wallet)
+# keep their own independent versions — only the released binary tracks the workspace version.
+version = "0.31.3"
 
 # Release hardening, matching digstore: keep integer-overflow checks ON in release.
 # The node parses untrusted serialized input and does offset/length arithmetic over
diff --git a/cliff.toml b/cliff.toml
index dbe3a58..1546410 100644
--- a/cliff.toml
+++ b/cliff.toml
@@ -1,7 +1,7 @@
 # git-cliff changelog config — builds CHANGELOG.md from Conventional Commits.
-# Uniform across every DIG repo (Rust + JS/TS). Consumed by .github/workflows/release.yml,
-# which regenerates the changelog on merge and commits it BEFORE tagging (so the changelog
-# is included in the vX.Y.Z tag). See CLAUDE.md §3.6.
+# Uniform across every DIG repo (Rust + JS/TS). Consumed by nightly-release.yml's stable
+# channel (the nightly cron + manual dispatch), which regenerates the changelog + commits + tags.
+# See CLAUDE.md §3.6.
 [changelog]
 header = """
 # Changelog
diff --git a/crates/dig-node-service/Cargo.toml b/crates/dig-node-service/Cargo.toml
index 80d984d..74fcb8f 100644
--- a/crates/dig-node-service/Cargo.toml
+++ b/crates/dig-node-service/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "dig-node-service"
 # Inherits the workspace release version (root [workspace.package].version) so the
-# produced `dig-node` binary, the tag-on-merge tag, and the version-increment gate
+# produced `dig-node` binary, the nightly-release.yml tag, and the version-increment gate
 # all read ONE version from the root manifest (§2.4/§3.6). Bump it in Cargo.toml
 # (root) per SemVer.
 version.workspace = true