diff --git a/.github/workflows/update-demo-server.yml b/.github/workflows/update-demo-server.yml
index 1871720..5749777 100644
--- a/.github/workflows/update-demo-server.yml
+++ b/.github/workflows/update-demo-server.yml
@@ -17,7 +17,35 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Resolve target tag
+        id: target
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            TAG="${{ inputs.tag }}"
+          else
+            TAG="${{ github.event.release.tag_name }}"
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Skip if not latest published release
+        id: gate
+        if: github.event_name == 'release'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TARGET="${{ steps.target.outputs.tag }}"
+          LATEST=$(gh api "repos/${{ github.repository }}/releases/latest" --jq '.tag_name')
+          echo "Target tag: $TARGET"
+          echo "Latest published tag: $LATEST"
+          if [ "$TARGET" != "$LATEST" ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Release is not the latest; skipping demo update."
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Check release type
+        if: steps.gate.outputs.skip != 'true'
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             echo "Manual deployment triggered for: ${{ inputs.tag }}"
@@ -28,12 +56,9 @@ jobs:
           fi
 
       - name: Wait for release assets
+        if: steps.gate.outputs.skip != 'true'
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            TAG="${{ inputs.tag }}"
-          else
-            TAG="${{ github.event.release.tag_name }}"
-          fi
+          TAG="${{ steps.target.outputs.tag }}"
           echo "Waiting for release assets to be available..."
 
           MAX_ATTEMPTS=30
@@ -66,6 +91,7 @@ jobs:
           exit 1
 
       - name: Setup SSH
+        if: steps.gate.outputs.skip != 'true'
         run: |
           mkdir -p ~/.ssh
           echo "${{ secrets.DEMO_SERVER_SSH_KEY }}" > ~/.ssh/id_ed25519
@@ -73,11 +99,13 @@ jobs:
           ssh-keyscan -H ${{ secrets.DEMO_SERVER_HOST }} >> ~/.ssh/known_hosts
 
       - name: Update demo server
+        if: steps.gate.outputs.skip != 'true'
         run: |
           ssh -i ~/.ssh/id_ed25519 ${{ secrets.DEMO_SERVER_USER }}@${{ secrets.DEMO_SERVER_HOST }} \
             'curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | sudo bash'
 
       - name: Verify update
+        if: steps.gate.outputs.skip != 'true'
         run: |
           # Wait a moment for service to restart
           sleep 5
@@ -102,5 +130,5 @@ jobs:
           fi
 
       - name: Cleanup SSH key
-        if: always()
+        if: always() && steps.gate.outputs.skip != 'true'
         run: rm -f ~/.ssh/id_ed25519