diff --git a/linux/build/scripts/build-inner.sh b/linux/build/scripts/build-inner.sh
index 1dd0834..04726d1 100755
--- a/linux/build/scripts/build-inner.sh
+++ b/linux/build/scripts/build-inner.sh
@@ -33,14 +33,23 @@ cd "${REPO_ROOT}/linux/build/derivative-maker"
 # --build, --dist, or --config) trips the "unknown option" guard at
 # parse-cmd line 725. Spelling matters too: upstream uses --flavor
 # (American), not --flavour. --freedom is mandatory for amd64/i386.
-# Dist is implicit from --flavor (kicksecure-cli => bookworm), and
+# Dist is implicit from --flavor (kicksecure-cli => trixie), and
 # the silvermetal-base.conf is sourced into the env above rather than
 # passed as a flag because derivative-maker has no --config option.
+#
+# --allow-untagged true / --allow-uncommitted true: the pinned upstream
+# tag (18.1.7.4-developers-only — name says it all) deliberately ships
+# with some submodules at intermediate / merge commits. sq-git still
+# verifies every signature in the chain — these flags only relax the
+# additional "must be at a release tag" check. Appropriate for a
+# downstream consumer pinned to a developer tag.
 ./derivative-maker \
-    --flavor  "${DERIVATIVE_FLAVOUR}" \
-    --target  "${DERIVATIVE_BUILD_TARGET}" \
-    --arch    "${DERIVATIVE_TARGET_ARCH}" \
-    --freedom "${DERIVATIVE_FREEDOM}"
+    --flavor            "${DERIVATIVE_FLAVOUR}" \
+    --target            "${DERIVATIVE_BUILD_TARGET}" \
+    --arch              "${DERIVATIVE_TARGET_ARCH}" \
+    --freedom           "${DERIVATIVE_FREEDOM}" \
+    --allow-untagged    true \
+    --allow-uncommitted true
 
 # derivative-maker writes into its own build/ tree; collect into BUILD_DIR.
 # Exact upstream output paths can shift between tags — keep this tolerant.