diff --git a/.gitea/scripts/check-already-published.sh b/.gitea/scripts/check-already-published.sh
index 1c19dc853..21f000e15 100755
--- a/.gitea/scripts/check-already-published.sh
+++ b/.gitea/scripts/check-already-published.sh
@@ -193,13 +193,33 @@ debian)
   esac
 
   pkg_name=$(basename "$RECIPE_DIR")
-  first_letter="${pkg_name:0:1}"
 
-  url="${REPO_BASE}/debian/pool/main/${first_letter}/${pkg_name}/${pkg_name}_${ver_full}_${file_arch}.deb"
-  code=$(http_head "$url")
-  if [ "$code" = "200" ]; then
+  # Compare against the canonical Packages index (what apt actually
+  # consults).  reprepro refuses lower-version uploads, so checking
+  # only an exact source-pkgrel URL produces an endless-rebuild trap
+  # whenever source PKGREL has rolled back below pool head.  We skip
+  # if pools published version >= source version-tuple.
+  source_full="${ver_full}"
+  if [ -n "${PKGVER#*:}" ] && [ "${PKGVER}" != "${PKGVER#*:}" ]; then
+    # PKGVER had an epoch — keep it for dpkg --compare-versions.
+    source_full="${PKGVER}-${PKGREL}"
+  fi
+
+  # Determine suite: most recipes publish to both bookworm and trixie;
+  # checking trixie is sufficient (changelogs share Distribution).
+  suite="trixie"
+  pkg_arch_label="$file_arch"
+  [ "$file_arch" = "all" ] && pkg_arch_label="all"
+  packages_url="${REPO_BASE}/debian/dists/${suite}/main/binary-arm64/Packages"
+  [ "$file_arch" = "amd64" ] && packages_url="${REPO_BASE}/debian/dists/${suite}/main/binary-amd64/Packages"
+
+  pool_ver=$(set +o pipefail; curl -sS --max-time "$HEAD_TIMEOUT" "$packages_url" 2>/dev/null     | awk -v p="$pkg_name" '$1=="Package:" && $2==p {found=1; next} found && $1=="Version:" {print $2; exit}')
+
+  if [ -n "$pool_ver" ] && command -v dpkg >/dev/null &&        dpkg --compare-versions "$pool_ver" ge "$source_full"; then
+    echo "pool has $pool_ver >= source $source_full" >&2
     emit 1
   fi
+  echo "pool has $pool_ver, source wants $source_full — build" >&2
   emit 0
   ;;