diff --git a/.github/workflows/release-prod.yml b/.github/workflows/release-prod.yml
index 20ffdf49..2be50e64 100644
--- a/.github/workflows/release-prod.yml
+++ b/.github/workflows/release-prod.yml
@@ -190,6 +190,10 @@ jobs:
           # the checksum of every artefact, so the agent can verify what it
           # downloaded before it swaps anything into place.
           #
+          # The order matters: units are restarted in the order they appear
+          # here, and the API's AUTH_INTERNAL_URL names the issuer, so the
+          # issuer comes back first.
+          #
           # `unit` is what gets restarted. `nestri-migrate` has none on purpose
           # — it is run, not served — and `migrate: true` is what makes the
           # deploy run it *before* the swap. That ordering is why migrations
@@ -205,16 +209,16 @@ jobs:
             "run": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
             "migrate": true,
             "artefacts": [
-              {
-                "name": "nestri-api",
-                "unit": "nestri-api",
-                "sha256": "$(sha256sum nestri-api | cut -d' ' -f1)"
-              },
               {
                 "name": "nestri-auth",
                 "unit": "nestri-auth",
                 "sha256": "$(sha256sum nestri-auth | cut -d' ' -f1)"
               },
+              {
+                "name": "nestri-api",
+                "unit": "nestri-api",
+                "sha256": "$(sha256sum nestri-api | cut -d' ' -f1)"
+              },
               {
                 "name": "nestri-migrate",
                 "sha256": "$(sha256sum nestri-migrate | cut -d' ' -f1)"