diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3f324e7..35b0efb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,8 +45,10 @@ jobs:
   # parse fails their build before a single step of ours runs, with an error
   # naming a line in this repository. Same argument as the publish dry run.
   #
-  # Findings are not the point here and do not fail the job: what is being
-  # proved is that the manifest loads, the install works, and the scan runs.
+  # It fails on findings, because the release smoke test does, and a finding
+  # that only surfaces there surfaces after the tag is pushed -- which is
+  # exactly what happened to v0.1.2. This job is the same scan, run early
+  # enough to be fixable.
   action:
     name: action
     runs-on: ubuntu-latest
@@ -56,5 +58,3 @@ jobs:
       - uses: ./
         with:
           token: ${{ github.token }}
-          fail-on-findings: "false"
-          fail-on-unused-markers: "false"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 291081a..cf4f640 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,19 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-08-25
+
+### Fixed
+
+- Straitjacket passes its own `no-comments` rule again. `site/wrangler.toml`
+  explained itself in three lines the rule does not allow -- one past the ten
+  the file header gets, and two more down beside the setting they described.
+  The reasoning is intact, folded into the header.
+- The `action` CI job fails on findings. It did not, so the first thing to
+  notice the above was the release smoke test, after the tag was pushed and
+  after the release was published. The check that catches a finding has to run
+  where a finding can still be fixed.
+
 ## [0.1.2] - 2026-08-25
 
 ### Fixed
@@ -104,7 +117,8 @@ prebuilt archives for Linux (`x86_64`, `aarch64`, static musl) and macOS
   `[facts]`, `[effects]` or `[errors]` section is rejected with an error naming
   the rules that went away.
 
-[Unreleased]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.2...HEAD
+[Unreleased]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.3...HEAD
+[0.1.3]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/PowderworksCode/straitjacket/releases/tag/v0.1.0
diff --git a/Cargo.lock b/Cargo.lock
index 2f30e0e..10e1558 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "straitjacket"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "anyhow",
  "clap",
diff --git a/Cargo.toml b/Cargo.toml
index 93a7060..218a6c5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "straitjacket"
-version = "0.1.2"
+version = "0.1.3"
 edition = "2024"
 description = "A fast, deterministic scanner that flags the weird code and text LLMs produce."
 license = "MIT"
diff --git a/README.md b/README.md
index c0e735c..bab26f3 100644
--- a/README.md
+++ b/README.md
@@ -67,7 +67,7 @@ cargo install straitjacket
 ## GitHub Actions
 
 ```yaml
-- uses: PowderworksCode/straitjacket@v0.1.2
+- uses: PowderworksCode/straitjacket@v0.1.3
 ```
 
 That installs Straitjacket and scans the checked-out repository, failing the
@@ -81,7 +81,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v5
-  - uses: PowderworksCode/straitjacket@v0.1.2
+  - uses: PowderworksCode/straitjacket@v0.1.3
     with:
       sarif-file: straitjacket.sarif
       fail-on-findings: "false"
@@ -95,7 +95,7 @@ YAML rather than by assembling an argument string:
 
 | input | default | meaning |
 | --- | --- | --- |
-| `version` | `latest` | Release tag to install, such as `v0.1.2`. |
+| `version` | `latest` | Release tag to install, such as `v0.1.3`. |
 | `paths` | `.` | Files or directories to scan. |
 | `only` | none | Run only these rules. |
 | `skip` | none | Disable these rules. |
@@ -116,14 +116,14 @@ YAML rather than by assembling an argument string:
 these mean the same thing:
 
 ```yaml
-- uses: PowderworksCode/straitjacket@v0.1.2
+- uses: PowderworksCode/straitjacket@v0.1.3
   with:
     paths: src tests
     only: color,emoji
 ```
 
 ```yaml
-- uses: PowderworksCode/straitjacket@v0.1.2
+- uses: PowderworksCode/straitjacket@v0.1.3
   with:
     paths: |
       src
diff --git a/site/content/rules.json b/site/content/rules.json
index 7b480d9..2331f57 100644
--- a/site/content/rules.json
+++ b/site/content/rules.json
@@ -1,6 +1,6 @@
 {
   "schema": "straitjacket.rules/1",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "rules": [
     {
       "id": "color",
diff --git a/site/wrangler.toml b/site/wrangler.toml
index 576e053..e4753d5 100644
--- a/site/wrangler.toml
+++ b/site/wrangler.toml
@@ -1,14 +1,13 @@
-# Cloudflare Workers config for the straitjacket docs site.
-#
-# The site is a Next.js static export (`output: 'export'` -> ./out), deployed
-# as a Worker over static assets. The worker exists for one job: when an agent
-# asks for a docs page with `Accept: text/markdown`, it serves that page's
-# markdown twin (the /llms.mdx/... assets) instead of the HTML. Everything
-# else passes straight through to the assets, untouched.
-#
-# Workers Build settings — root directory `site`, build `bun run build`, deploy
-# `bun run deploy`. Both go through package.json so wrangler comes from the
-# lockfile; `npx wrangler` would fetch whatever is newest at deploy time.
+# Cloudflare Workers config for the straitjacket docs site: a Next.js static
+# export (`output: 'export'` -> ./out) served as a Worker over static assets.
+# The worker exists for one job -- when an agent asks for a docs page with
+# `Accept: text/markdown`, it serves that page's markdown twin (the
+# /llms.mdx/... assets) instead of the HTML -- which is why `run_worker_first`
+# below lists only /docs: every other path is served from assets without
+# invoking the worker at all. Workers Build settings are root directory
+# `site`, build `bun run build`, deploy `bun run deploy`; both go through
+# package.json so wrangler comes from the lockfile, where `npx wrangler`
+# would fetch whatever is newest at deploy time.
 name = "straitjacket"
 main = "worker.ts"
 compatibility_date = "2026-07-01"
@@ -18,6 +17,4 @@ directory = "./out"
 not_found_handling = "404-page"
 binding = "ASSETS"
 
-# Only docs pages can negotiate; every other path is served from assets
-# without invoking the worker at all.
 run_worker_first = ["/docs", "/docs/*"]