diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8e390f7..c5d93e4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -86,6 +86,9 @@ jobs:
 
       - name: derive version
         id: version
+        # Deb container images default this step to dash, which lacks
+        # ${VAR::7} — same trap the validate steps already pin bash for.
+        shell: bash
         run: |
           if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
               VERSION="${GITHUB_REF_NAME#v}"
diff --git a/doc/Changelog b/doc/Changelog
index d32b8d0..762ff10 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -7,6 +7,9 @@ The keys used are:
   !: fixed/modified feature, -: deleted feature, +: new feature
 
 
+current (main branch) -- 11-07-2026
+  ! Fixing the `derive version` step in release.yml for non-tag runs: the deb container images (debian:12/13, ubuntu:24.04) default run-steps to dash, which rejects the bash-only `${GITHUB_SHA::7}` substring with "Bad substitution" — the first-ever workflow_dispatch run failed on all three deb legs while fedora (bash default) passed. The bug was latent since the job was introduced: tag pushes take the POSIX-safe `${GITHUB_REF_NAME#v}` branch, so the else-branch had never executed before. Pinned `shell: bash` on the step — the same fix the validate sub-steps already carry for the same dash trap.
+
 current (main branch) -- 10-07-2026
   ! Fixing the false-negative huawei FAIL in tests/e2e/run.sh --pmtelemetryd. pmtelemetryd mixes per-peer `event_type: log_init` records into the msglog kafka topic (one per connecting vendor peer), but the harness consumed a fixed `--num $((vendors * COUNT))` from offset start — so the 4 log_init records displaced the last 4 data records, which are always the final vendor's (huawei) canaries 2-5. No telemetry was lost anywhere: a full-topic autopsy shows 24 records = 20/20 canaries + 4 log_init; the collector logs confirm all 5 huawei ZmqPusher sends. The consume step now reads the whole topic (`rpk topic consume -o :end`) and polls until every canary has landed (30 s budget, 2 s intervals), making the assertion robust to any interleaved non-canary records on both the standalone and pmtelemetryd paths.
   ! Fixing the four mdt-dialout-collector-lib packaging bugs reported by a pmacct integrator (pmacct's ./configure --enable-grpc-collector could not consume the v1.2.0 .deb at all). (1) The shipped pkg-config file was named grpc_collector.pc while pmacct's PKG_CHECK_MODULES asks for the module "grpc-collector" — pkg-config matches by exact filename, so the module was never found; the package now ships grpc-collector.pc (matching the grpc-collector.pc.in template name and the autotools-generated file). (2) The Version field shipped as the literal "@VERSION@" — pkg/build/build_collector.sh sed-substituted the token @PACKAGE_VERSION@, which does not appear in the template; the sed now targets @VERSION@ and strips the leading "v" from the VERSION file (matching the docker library stage and the nfpm package version). (3) Cflags pointed one directory too deep (-I${includedir}/grpc_collector_bridge), so pmacct's #include <grpc_collector_bridge/grpc_collector_bridge.h> resolved to a non-existent doubled path; fixed in grpc-collector.pc.in to -I${includedir} — this also corrects the autotools-installed .pc, which only worked by accident because /usr/local/include is on the compiler's default search path.