diff --git a/.github/scripts/bump_version.sh b/.github/scripts/bump_version.sh
index 17e4b5bb..f1d364e7 100755
--- a/.github/scripts/bump_version.sh
+++ b/.github/scripts/bump_version.sh
@@ -260,6 +260,13 @@ def sub_one(path, pattern, repl, required=True):
     text = p.read_text(encoding="utf-8")
     new, n = re.subn(pattern, repl, text, count=1)
     if n != 1:
+        # required=False skips a missing file and a file that simply
+        # does not contain the pin. docs/getting-started/local.md ships
+        # ARBITER_VERSION=latest, which is not a numeric tag, and a
+        # prepare-release tree (1.0.0 already in CMakeLists) must still
+        # be able to tag. A required pin that does not match once is fatal.
+        if not required and n == 0:
+            return
         sys.exit(f"bump_version: failed to patch {path} ({n} matches)")
     p.write_text(new, encoding="utf-8")
 
diff --git a/.github/scripts/test_bump_version.sh b/.github/scripts/test_bump_version.sh
index bb4bad90..6903a0e5 100755
--- a/.github/scripts/test_bump_version.sh
+++ b/.github/scripts/test_bump_version.sh
@@ -203,6 +203,34 @@ make_fixture 0.12.0 0.12.0
 assert_eq "tag" "$(git tag --list 'v0.12.1')" "v0.12.1"
 assert_eq "subject" "$(git log -1 --format=%s)" "chore(release): v0.12.1"
 
+begin_case "latest install pin is left alone when cmake is already ahead"
+make_fixture 1.0.0 0.13.14
+python3 - <<'PY'
+from pathlib import Path
+local = Path("docs/getting-started/local.md")
+local.write_text(
+    "curl -fsSL https://example.com/install.sh | ARBITER_VERSION=latest sh\n"
+)
+changelog = Path("CHANGELOG.md")
+text = changelog.read_text()
+text = text.replace(
+    "## [Unreleased]\n\n### Added\n- New thing.\n",
+    "## [Unreleased]\n\n## [1.0.0] — 2026-10-15\n\nAlready cut.\n\n",
+)
+changelog.write_text(text)
+PY
+git add CHANGELOG.md docs/getting-started/local.md
+git commit -q -m "prepare 1.0.0"
+before="$(git rev-parse HEAD)"
+"$SCRIPT" --mode auto --no-tag >bump.out
+assert_eq "next" "$(out_field version bump.out)" "1.0.0"
+assert_eq "skipped" "$(out_field skipped bump.out)" "false"
+assert_file_contains "latest pin kept" docs/getting-started/local.md "ARBITER_VERSION=latest"
+assert_file_not_contains "did not invent a numeric pin" docs/getting-started/local.md "ARBITER_VERSION=v1.0.0"
+assert_eq "no release commit" "$(git rev-parse HEAD)" "$before"
+count="$(grep -c '## \[1.0.0\]' CHANGELOG.md || true)"
+assert_eq "single heading" "$count" "1"
+
 begin_case "no-tag commits without creating a tag"
 make_fixture 0.12.0 0.12.0
 "$SCRIPT" --mode auto --no-tag >bump.out