diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 6c574f4a5..dc90ce386 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -82,6 +82,16 @@ jobs:
           for ext in xz zst gz; do
             for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
           done
+          # Force-replace db entries: remove the package by name first so the
+          # subsequent --new add records this build's CSIZE/SHA256, not the
+          # previous build's. (makepkg output isn't byte-stable across runs.)
+          if [ -f marfrit.db.tar.gz ]; then
+            for f in "${pkgs[@]}"; do
+              name=$(echo "$f" | sed -E 's/-[0-9].*//')
+              repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+                marfrit.db.tar.gz "$name" 2>/dev/null || true
+            done
+          fi
           repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
             --verify marfrit.db.tar.gz "${pkgs[@]}"
           ln -sf marfrit.db.tar.gz        marfrit.db
@@ -226,6 +236,13 @@ jobs:
               for ext in xz zst gz; do
                 for f in *.pkg.tar.$ext; do [ -f "$f" ] && pkgs+=("$f"); done
               done
+              if [ -f marfrit.db.tar.gz ]; then
+                for f in "${pkgs[@]}"; do
+                  name=$(echo "$f" | sed -E 's/-[0-9].*//')
+                  repo-remove --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
+                    marfrit.db.tar.gz "$name" 2>/dev/null || true
+                done
+              fi
               repo-add --new --sign --key 92D5E96D8F63C75E4116AA1FF5C8C4603D0D250C \
                 --verify marfrit.db.tar.gz "${pkgs[@]}"
               ln -sf marfrit.db.tar.gz        marfrit.db