diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f9041a6..8fea73c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -155,46 +155,6 @@ jobs:
           if-no-files-found: error
           retention-days: 90
 
-  publish-oci:
-    name: Publish OCI artifact to GHCR (ORAS)
-    needs: build
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Download arm64 binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: binaries-arm64
-          path: dist/
-
-      - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish microinit-linux-arm64
-        run: ./scripts/publish-oci-microinit.sh dist/microinit-linux-arm64 dist/early-boot.sh dist/unmount.sh dist/shutdown-linux-arm64
-
-      - name: Job summary
-        run: |
-          {
-            echo "### OCI publish (ORAS)"
-            echo ""
-            echo "- Image: \`ghcr.io/dcc-bigfred/microinit-linux-arm64\`"
-            echo "- Tags: \`main\`, \`sha-${GITHUB_SHA::7}\`"
-          } >> "$GITHUB_STEP_SUMMARY"
-
   build-android:
     name: Build Android (${{ matrix.name }})
     needs: test
@@ -261,52 +221,6 @@ jobs:
           if-no-files-found: error
           retention-days: 90
 
-  publish-oci-android:
-    name: Publish Android OCI artifact to GHCR (ORAS)
-    needs: build-android
-    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Download Android arm64 binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: binaries-android-arm64
-          path: dist/
-
-      - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish microinit-android-arm64
-        run: |
-          set -euo pipefail
-          microinit=dist/libmicroinit.so
-          shutdown=dist/libshutdown.so
-          [[ -f "${microinit}" ]] || microinit=dist/microinit-android-arm64
-          [[ -f "${shutdown}" ]] || shutdown=dist/shutdown-android-arm64
-          ./scripts/publish-oci-microinit-android.sh "${microinit}" "${shutdown}"
-
-      - name: Job summary
-        run: |
-          {
-            echo "### Android OCI publish (ORAS)"
-            echo ""
-            echo "- Image: \`ghcr.io/dcc-bigfred/microinit-android-arm64\`"
-            echo "- Tags: \`main\`, \`sha-${GITHUB_SHA::7}\`"
-          } >> "$GITHUB_STEP_SUMMARY"
-
   publish-image:
     name: Publish distroless container image
     needs: build
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a74fe0b..44bacfa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,6 +81,66 @@ jobs:
             rm -rf "release-assets/android-${arch}"
           done
 
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+
+      - name: Install cross objcopy for ELF rewrite
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          # aarch64 (linux + android arm64) and arm (android armv7) on amd64 runner;
+          # native objcopy covers x86_64. inject-elf-version prefers llvm-objcopy when present.
+          sudo apt-get install -y --no-install-recommends \
+            binutils-aarch64-linux-gnu \
+            binutils-arm-linux-gnueabihf
+
+      - name: Inject release version into ELF binaries
+        env:
+          GOPROXY: direct
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF_NAME}"
+          COMMIT="${GITHUB_SHA::7}"
+          INJECT="github.com/dcc-bigfred/common/cmd/inject-elf-version@latest"
+          find release-assets -type f -print0 | while IFS= read -r -d '' f; do
+            if file -b "$f" | grep -qi 'ELF'; then
+              go run "${INJECT}" "$f" "$TAG" "$COMMIT" .microinit.version
+            else
+              echo "skip (not ELF): $f"
+            fi
+          done
+
+      - name: Refresh SHA256SUMS after ELF inject
+        run: |
+          set -euo pipefail
+          # CI ships SHA256SUMS for the arm64 linux artifact. ELF inject changes
+          # those binaries, so the published checksums must be recomputed.
+          sums=release-assets/SHA256SUMS
+          if [ ! -f "${sums}" ]; then
+            echo "no SHA256SUMS in release-assets; skipping refresh"
+            exit 0
+          fi
+          (
+            cd release-assets
+            mapfile -t names < <(awk '{print $2}' SHA256SUMS)
+            if [ "${#names[@]}" -eq 0 ]; then
+              echo "error: SHA256SUMS is empty" >&2
+              exit 1
+            fi
+            for n in "${names[@]}"; do
+              if [ ! -f "${n}" ]; then
+                echo "error: SHA256SUMS lists missing file: ${n}" >&2
+                exit 1
+              fi
+            done
+            sha256sum -- "${names[@]}" > SHA256SUMS.new
+            mv -f SHA256SUMS.new SHA256SUMS
+            echo "refreshed SHA256SUMS (${#names[@]} entries)"
+            cat SHA256SUMS
+          )
+
       - name: Create release if missing
         env:
           GH_TOKEN: ${{ github.token }}
@@ -108,9 +168,6 @@ jobs:
           fi
           gh release upload "$TAG" "${FILES[@]}" --clobber
 
-      - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -121,12 +178,6 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Retag microinit ORAS artifact from main
-        run: ./scripts/retag-oci-microinit.sh "${GITHUB_REF_NAME}"
-
-      - name: Retag microinit Android ORAS artifact from main
-        run: ./scripts/retag-oci-microinit-android.sh "${GITHUB_REF_NAME}"
-
       - name: Retag distroless container image from main
         run: ./scripts/retag-oci-microinit-image.sh "${GITHUB_REF_NAME}"
 
@@ -136,8 +187,6 @@ jobs:
             echo "### Release ${GITHUB_REF_NAME}"
             echo ""
             echo "- GitHub Release assets uploaded (linux + android)"
-            echo "- ORAS: \`ghcr.io/dcc-bigfred/microinit-linux-arm64:${GITHUB_REF_NAME}\`"
-            echo "- ORAS: \`ghcr.io/dcc-bigfred/microinit-android-arm64:${GITHUB_REF_NAME}\`"
             echo "- Image: \`ghcr.io/dcc-bigfred/microinit:${GITHUB_REF_NAME}\`"
             echo "- Image: \`ghcr.io/dcc-bigfred/microinit:latest-release\`"
           } >> "$GITHUB_STEP_SUMMARY"
diff --git a/scripts/inject-elf-version.sh b/scripts/inject-elf-version.sh
deleted file mode 100755
index 39197b8..0000000
--- a/scripts/inject-elf-version.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-# Inject release version metadata into an ELF binary as section
-# .microinit.version (JSON {"version":"v1.2.3","commit":"abc1234"}).
-# Usage: inject-elf-version.sh <binary> <version> <tag-commit>
-set -euo pipefail
-
-BINARY="${1:?usage: $0 <binary> <version> <tag-commit>}"
-VERSION="${2:?}"
-TAG_COMMIT="${3:?}"
-
-if [[ ! -f "${BINARY}" ]]; then
-  echo "error: binary not found: ${BINARY}" >&2
-  exit 1
-fi
-
-if ! command -v objcopy >/dev/null 2>&1; then
-  echo "error: objcopy not found (install binutils)" >&2
-  exit 1
-fi
-
-tmpdir="$(mktemp -d)"
-cleanup() { rm -rf "${tmpdir}"; }
-trap cleanup EXIT
-
-section_file="${tmpdir}/microinit.version.json"
-printf '{"version":"%s","commit":"%s"}' "${VERSION}" "${TAG_COMMIT}" > "${section_file}"
-
-objcopy --remove-section .microinit.version "${BINARY}" 2>/dev/null || true
-objcopy --add-section ".microinit.version=${section_file}" "${BINARY}"
-
-echo "Injected .microinit.version into ${BINARY}: version=${VERSION} commit=${TAG_COMMIT}"
diff --git a/scripts/publish-oci-microinit-android.sh b/scripts/publish-oci-microinit-android.sh
deleted file mode 100755
index 0beb623..0000000
--- a/scripts/publish-oci-microinit-android.sh
+++ /dev/null
@@ -1,66 +0,0 @@
-#!/usr/bin/env bash
-# Publish microinit Android/arm64 OCI artifact to GHCR (ORAS).
-# Intended for CI on push to main/master only.
-# Usage: publish-oci-microinit-android.sh <libmicroinit.so|microinit-android-arm64> [libshutdown.so|shutdown-android-arm64]
-#
-# Tags: main, sha-<7>
-set -euo pipefail
-
-BIN="${1:?usage: $0 <libmicroinit.so|microinit-android-arm64> [libshutdown.so|shutdown-android-arm64]}"
-SHUTDOWN="${2:-}"
-IMAGE="${MICROINIT_OCI_ANDROID_IMAGE:-ghcr.io/dcc-bigfred/microinit-android-arm64}"
-BIN_MEDIA_TYPE="application/vnd.dcc-bigfred.microinit.android.arm64.v1"
-SHUTDOWN_MEDIA_TYPE="application/vnd.dcc-bigfred.shutdown.android.arm64.v1"
-
-if [[ ! -f "${BIN}" ]]; then
-  echo "error: binary not found: ${BIN}" >&2
-  exit 1
-fi
-
-BRANCH="${GITHUB_REF_NAME:?GITHUB_REF_NAME required}"
-if [[ "${BRANCH}" != "master" && "${BRANCH}" != "main" ]]; then
-  echo "error: OCI publish is only allowed from master/main (got ${BRANCH})" >&2
-  exit 1
-fi
-
-SHA_TAG="sha-${GITHUB_SHA::7}"
-
-tmpdir="$(mktemp -d)"
-cleanup() { rm -rf "${tmpdir}"; }
-trap cleanup EXIT
-
-# Publish jniLibs-compatible layer names even when a legacy artifact is passed.
-cp -f "${BIN}" "${tmpdir}/libmicroinit.so"
-chmod 755 "${tmpdir}/libmicroinit.so"
-
-layers=(
-  "libmicroinit.so:${BIN_MEDIA_TYPE}"
-)
-
-if [[ -n "${SHUTDOWN}" ]]; then
-  if [[ ! -f "${SHUTDOWN}" ]]; then
-    echo "error: shutdown binary not found: ${SHUTDOWN}" >&2
-    exit 1
-  fi
-  cp -f "${SHUTDOWN}" "${tmpdir}/libshutdown.so"
-  chmod 755 "${tmpdir}/libshutdown.so"
-  layers+=("libshutdown.so:${SHUTDOWN_MEDIA_TYPE}")
-fi
-
-annotate=(
-  --annotation "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
-  --annotation "org.opencontainers.image.revision=${GITHUB_SHA}"
-  --annotation "org.opencontainers.image.title=microinit-android"
-  --annotation "org.opencontainers.image.description=microinit static binary for Android (Bionic/arm64)"
-)
-
-echo "Publishing ${IMAGE}:main and :${SHA_TAG}"
-echo "  libmicroinit.so: $(wc -c < "${tmpdir}/libmicroinit.so") bytes"
-if [[ -f "${tmpdir}/libshutdown.so" ]]; then
-  echo "  libshutdown.so:  $(wc -c < "${tmpdir}/libshutdown.so") bytes"
-fi
-(
-  cd "${tmpdir}"
-  oras push "${IMAGE}:main" "${layers[@]}" "${annotate[@]}"
-  oras push "${IMAGE}:${SHA_TAG}" "${layers[@]}" "${annotate[@]}"
-)
diff --git a/scripts/publish-oci-microinit.sh b/scripts/publish-oci-microinit.sh
deleted file mode 100755
index c1d7351..0000000
--- a/scripts/publish-oci-microinit.sh
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-# Publish microinit linux/arm64 OCI artifact to GHCR (ORAS).
-# Intended for CI on push to main/master only.
-# Usage: publish-oci-microinit.sh <microinit-linux-arm64> [early-boot.sh] [unmount.sh] [shutdown-linux-arm64]
-#
-# Tags: main, sha-<7>
-#
-# ORAS rejects absolute file paths unless --disable-path-validation is set;
-# we push from a staging dir with relative basenames.
-set -euo pipefail
-
-BIN="${1:?usage: $0 <microinit-linux-arm64> [early-boot.sh] [unmount.sh] [shutdown-linux-arm64]}"
-EARLY_BOOT="${2:-}"
-UNMOUNT="${3:-}"
-SHUTDOWN="${4:-}"
-IMAGE="${MICROINIT_OCI_IMAGE:-ghcr.io/dcc-bigfred/microinit-linux-arm64}"
-BIN_MEDIA_TYPE="application/vnd.dcc-bigfred.microinit.linux.arm64.v1"
-EARLY_MEDIA_TYPE="application/vnd.dcc-bigfred.microinit.early-boot.sh.v1"
-UNMOUNT_MEDIA_TYPE="application/vnd.dcc-bigfred.microinit.unmount.sh.v1"
-SHUTDOWN_MEDIA_TYPE="application/vnd.dcc-bigfred.shutdown.linux.arm64.v1"
-
-if [[ ! -f "${BIN}" ]]; then
-  echo "error: binary not found: ${BIN}" >&2
-  exit 1
-fi
-
-BRANCH="${GITHUB_REF_NAME:?GITHUB_REF_NAME required}"
-if [[ "${BRANCH}" != "master" && "${BRANCH}" != "main" ]]; then
-  echo "error: OCI publish is only allowed from master/main (got ${BRANCH})" >&2
-  exit 1
-fi
-
-SHA_TAG="sha-${GITHUB_SHA::7}"
-
-tmpdir="$(mktemp -d)"
-cleanup() { rm -rf "${tmpdir}"; }
-trap cleanup EXIT
-
-cp -f "${BIN}" "${tmpdir}/microinit-linux-arm64"
-chmod 755 "${tmpdir}/microinit-linux-arm64"
-
-layers=(
-  "microinit-linux-arm64:${BIN_MEDIA_TYPE}"
-)
-
-if [[ -n "${EARLY_BOOT}" ]]; then
-  if [[ ! -f "${EARLY_BOOT}" ]]; then
-    echo "error: early-boot script not found: ${EARLY_BOOT}" >&2
-    exit 1
-  fi
-  cp -f "${EARLY_BOOT}" "${tmpdir}/early-boot.sh"
-  chmod 755 "${tmpdir}/early-boot.sh"
-  layers+=("early-boot.sh:${EARLY_MEDIA_TYPE}")
-fi
-
-if [[ -n "${UNMOUNT}" ]]; then
-  if [[ ! -f "${UNMOUNT}" ]]; then
-    echo "error: unmount script not found: ${UNMOUNT}" >&2
-    exit 1
-  fi
-  cp -f "${UNMOUNT}" "${tmpdir}/unmount.sh"
-  chmod 755 "${tmpdir}/unmount.sh"
-  layers+=("unmount.sh:${UNMOUNT_MEDIA_TYPE}")
-fi
-
-if [[ -n "${SHUTDOWN}" ]]; then
-  if [[ ! -f "${SHUTDOWN}" ]]; then
-    echo "error: shutdown binary not found: ${SHUTDOWN}" >&2
-    exit 1
-  fi
-  cp -f "${SHUTDOWN}" "${tmpdir}/shutdown-linux-arm64"
-  chmod 755 "${tmpdir}/shutdown-linux-arm64"
-  layers+=("shutdown-linux-arm64:${SHUTDOWN_MEDIA_TYPE}")
-fi
-
-annotate=(
-  --annotation "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}"
-  --annotation "org.opencontainers.image.revision=${GITHUB_SHA}"
-  --annotation "org.opencontainers.image.title=microinit"
-)
-
-echo "Publishing ${IMAGE}:main and :${SHA_TAG}"
-echo "  microinit: $(wc -c < "${tmpdir}/microinit-linux-arm64") bytes"
-if [[ -f "${tmpdir}/shutdown-linux-arm64" ]]; then
-  echo "  shutdown:  $(wc -c < "${tmpdir}/shutdown-linux-arm64") bytes"
-fi
-(
-  cd "${tmpdir}"
-  oras push "${IMAGE}:main" "${layers[@]}" "${annotate[@]}"
-  oras push "${IMAGE}:${SHA_TAG}" "${layers[@]}" "${annotate[@]}"
-)
diff --git a/scripts/retag-oci-microinit-android.sh b/scripts/retag-oci-microinit-android.sh
deleted file mode 100755
index a04de9b..0000000
--- a/scripts/retag-oci-microinit-android.sh
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-# Retag the microinit Android/arm64 OCI artifact from :main to a release tag and
-# latest-release.
-# Usage: retag-oci-microinit-android.sh <release-tag>   e.g. v0.1.0
-set -euo pipefail
-
-RELEASE_TAG="${1:?usage: $0 <release-tag>}"
-IMAGE="${MICROINIT_OCI_ANDROID_IMAGE:-ghcr.io/dcc-bigfred/microinit-android-arm64}"
-BIN_MEDIA_TYPE="application/vnd.dcc-bigfred.microinit.android.arm64.v1"
-SHUTDOWN_MEDIA_TYPE="application/vnd.dcc-bigfred.shutdown.android.arm64.v1"
-TAG_COMMIT="${GITHUB_SHA:?GITHUB_SHA required (tag commit)}"
-
-tmpdir="$(mktemp -d)"
-cleanup() { rm -rf "${tmpdir}"; }
-trap cleanup EXIT
-
-echo "Pulling ${IMAGE}:main…"
-oras pull "${IMAGE}:main" -o "${tmpdir}"
-
-find_layer() {
-  local want="$1"
-  if [[ -f "${tmpdir}/${want}" ]]; then
-    echo "${want}"
-    return 0
-  fi
-  mapfile -t files < <(find "${tmpdir}" -type f \
-    ! -name 'manifest.json' ! -name 'config.json' \
-    -name "${want}" -printf '%f\n')
-  if [[ ${#files[@]} -eq 1 ]]; then
-    echo "${files[0]}"
-    return 0
-  fi
-  return 1
-}
-
-BIN_NAME="$(find_layer libmicroinit.so || find_layer microinit-android-arm64)" || true
-if [[ -z "${BIN_NAME}" ]]; then
-  echo "error: expected libmicroinit.so (or legacy microinit-android-arm64) in OCI artifact, found:" >&2
-  find "${tmpdir}" -type f >&2
-  exit 1
-fi
-# Normalize legacy layers to the jniLibs-compatible OCI layer names.
-if [[ "${BIN_NAME}" != "libmicroinit.so" ]]; then
-  cp -f "${tmpdir}/${BIN_NAME}" "${tmpdir}/libmicroinit.so"
-  chmod 755 "${tmpdir}/libmicroinit.so"
-fi
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-TAG_COMMIT_SHORT="${TAG_COMMIT:0:7}"
-"${SCRIPT_DIR}/inject-elf-version.sh" "${tmpdir}/libmicroinit.so" "${RELEASE_TAG}" "${TAG_COMMIT_SHORT}"
-
-push_args=(
-  "libmicroinit.so:${BIN_MEDIA_TYPE}"
-)
-
-SHUTDOWN_NAME="$(find_layer libshutdown.so || find_layer shutdown-android-arm64)" || true
-if [[ -n "${SHUTDOWN_NAME}" ]]; then
-  if [[ "${SHUTDOWN_NAME}" != "libshutdown.so" ]]; then
-    cp -f "${tmpdir}/${SHUTDOWN_NAME}" "${tmpdir}/libshutdown.so"
-    chmod 755 "${tmpdir}/libshutdown.so"
-  fi
-  "${SCRIPT_DIR}/inject-elf-version.sh" "${tmpdir}/libshutdown.so" "${RELEASE_TAG}" "${TAG_COMMIT_SHORT}"
-  push_args+=("libshutdown.so:${SHUTDOWN_MEDIA_TYPE}")
-fi
-
-annotate=(
-  --annotation "org.opencontainers.image.source=${GITHUB_SERVER_URL:-https://github.com}/${GITHUB_REPOSITORY:-dcc-bigfred/microinit}"
-  --annotation "org.opencontainers.image.revision=${TAG_COMMIT}"
-  --annotation "org.opencontainers.image.version=${RELEASE_TAG}"
-  --annotation "org.opencontainers.image.title=microinit-android"
-)
-
-echo "Publishing ${IMAGE}:${RELEASE_TAG} and :latest-release"
-echo "  libmicroinit.so: $(wc -c < "${tmpdir}/libmicroinit.so") bytes"
-if [[ -n "${SHUTDOWN_NAME}" ]]; then
-  echo "  libshutdown.so:  $(wc -c < "${tmpdir}/libshutdown.so") bytes"
-fi
-(
-  cd "${tmpdir}"
-  oras push "${IMAGE}:${RELEASE_TAG}" "${push_args[@]}" "${annotate[@]}"
-  oras push "${IMAGE}:latest-release" "${push_args[@]}" "${annotate[@]}"
-)
diff --git a/scripts/retag-oci-microinit.sh b/scripts/retag-oci-microinit.sh
deleted file mode 100755
index f80d583..0000000
--- a/scripts/retag-oci-microinit.sh
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/usr/bin/env bash
-# Retag the microinit linux/arm64 OCI artifact from :main to a release tag and
-# latest-release.
-# Usage: retag-oci-microinit.sh <release-tag>   e.g. v0.1.0
-#
-# Requires: GITHUB_SHA (tag commit), oras
-#
-# ORAS rejects absolute file paths; we push from the pull dir with relative names.
-set -euo pipefail
-
-RELEASE_TAG="${1:?usage: $0 <release-tag>}"
-IMAGE="${MICROINIT_OCI_IMAGE:-ghcr.io/dcc-bigfred/microinit-linux-arm64}"
-BIN_MEDIA_TYPE="application/vnd.dcc-bigfred.microinit.linux.arm64.v1"
-EARLY_MEDIA_TYPE="application/vnd.dcc-bigfred.microinit.early-boot.sh.v1"
-UNMOUNT_MEDIA_TYPE="application/vnd.dcc-bigfred.microinit.unmount.sh.v1"
-SHUTDOWN_MEDIA_TYPE="application/vnd.dcc-bigfred.shutdown.linux.arm64.v1"
-TAG_COMMIT="${GITHUB_SHA:?GITHUB_SHA required (tag commit)}"
-
-tmpdir="$(mktemp -d)"
-cleanup() { rm -rf "${tmpdir}"; }
-trap cleanup EXIT
-
-echo "Pulling ${IMAGE}:main…"
-oras pull "${IMAGE}:main" -o "${tmpdir}"
-
-find_layer() {
-  local want="$1"
-  if [[ -f "${tmpdir}/${want}" ]]; then
-    echo "${want}"
-    return 0
-  fi
-  mapfile -t files < <(find "${tmpdir}" -type f \
-    ! -name 'manifest.json' ! -name 'config.json' \
-    -name "${want}" -printf '%f\n')
-  if [[ ${#files[@]} -eq 1 ]]; then
-    echo "${files[0]}"
-    return 0
-  fi
-  return 1
-}
-
-BIN_NAME="$(find_layer microinit-linux-arm64)" || true
-if [[ -z "${BIN_NAME}" ]]; then
-  echo "error: expected microinit-linux-arm64 in OCI artifact, found:" >&2
-  find "${tmpdir}" -type f >&2
-  exit 1
-fi
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-TAG_COMMIT_SHORT="${TAG_COMMIT:0:7}"
-"${SCRIPT_DIR}/inject-elf-version.sh" "${tmpdir}/${BIN_NAME}" "${RELEASE_TAG}" "${TAG_COMMIT_SHORT}"
-
-push_args=(
-  "${BIN_NAME}:${BIN_MEDIA_TYPE}"
-)
-
-EARLY_NAME="$(find_layer early-boot.sh)" || true
-if [[ -n "${EARLY_NAME}" ]]; then
-  push_args+=("${EARLY_NAME}:${EARLY_MEDIA_TYPE}")
-fi
-
-UNMOUNT_NAME="$(find_layer unmount.sh)" || true
-if [[ -n "${UNMOUNT_NAME}" ]]; then
-  push_args+=("${UNMOUNT_NAME}:${UNMOUNT_MEDIA_TYPE}")
-fi
-
-SHUTDOWN_NAME="$(find_layer shutdown-linux-arm64)" || true
-if [[ -n "${SHUTDOWN_NAME}" ]]; then
-  "${SCRIPT_DIR}/inject-elf-version.sh" "${tmpdir}/${SHUTDOWN_NAME}" "${RELEASE_TAG}" "${TAG_COMMIT_SHORT}"
-  push_args+=("${SHUTDOWN_NAME}:${SHUTDOWN_MEDIA_TYPE}")
-fi
-
-annotate=(
-  --annotation "org.opencontainers.image.source=${GITHUB_SERVER_URL:-https://github.com}/${GITHUB_REPOSITORY:-dcc-bigfred/microinit}"
-  --annotation "org.opencontainers.image.revision=${TAG_COMMIT}"
-  --annotation "org.opencontainers.image.version=${RELEASE_TAG}"
-  --annotation "org.opencontainers.image.title=microinit"
-)
-
-echo "Publishing ${IMAGE}:${RELEASE_TAG} and :latest-release"
-echo "  microinit: $(wc -c < "${tmpdir}/${BIN_NAME}") bytes"
-if [[ -n "${SHUTDOWN_NAME}" ]]; then
-  echo "  shutdown:  $(wc -c < "${tmpdir}/${SHUTDOWN_NAME}") bytes"
-fi
-(
-  cd "${tmpdir}"
-  oras push "${IMAGE}:${RELEASE_TAG}" "${push_args[@]}" "${annotate[@]}"
-  oras push "${IMAGE}:latest-release" "${push_args[@]}" "${annotate[@]}"
-)
diff --git a/src/version.rs b/src/version.rs
index 66608bb..d885568 100644
--- a/src/version.rs
+++ b/src/version.rs
@@ -2,14 +2,15 @@
 //!
 //! - **Build-time:** `build_commit` / `build_time` from `build.rs` env.
 //! - **Post-build:** optional ELF section `.microinit.version` JSON
-//!   `{"version":"v1.2.3","commit":"abc1234"}` injected by release retag.
+//!   `{"version":"v1.2.3","commit":"abc1234"}` injected at release
+//!   (`go run …/cmd/inject-elf-version … .microinit.version`).
 
 use std::fs;
 use std::mem::MaybeUninit;
 use std::path::{Path, PathBuf};
 use std::sync::OnceLock;
 
-/// ELF section name (must match `scripts/inject-elf-version.sh`).
+/// ELF section name (must match `go run …/cmd/inject-elf-version … .microinit.version`).
 pub const SECTION_NAME: &str = ".microinit.version";
 
 /// Public version payload returned by `microinit info` / IPC.