diff --git a/deploy/runway-update b/deploy/runway-update
index cec46a1..275d865 100755
--- a/deploy/runway-update
+++ b/deploy/runway-update
@@ -121,7 +121,28 @@ mv "$staged" "$DIST"
 chmod -R a+rX "$DIST"
 
 # Then the backend, which runs the migrations as it starts.
-( cd "$COMPOSE_DIR" && "$rt" compose up -d "$SERVICE" )
+#
+# `--force-recreate`, because the tag does not move. `compose up -d` decides
+# whether to replace a container by comparing its *configuration*, and the
+# configuration here is the string `runway:latest` either way -- so a service
+# already running was left exactly where it was, every time, while the frontend
+# beside it was replaced on every run. That is this script's third variation on
+# the same theme and the worst of them: it does not fail, it half-succeeds, and
+# what it leaves behind is the one state the single-image design exists to
+# prevent -- a new frontend calling an API the running backend does not have.
+( cd "$COMPOSE_DIR" && "$rt" compose up -d --force-recreate "$SERVICE" )
+
+# So a half-deploy cannot be reported as a whole one. Everything above this
+# either worked or the script has already exited; what is checked here is the
+# thing no exit code covered -- that what is now running is what was just
+# pulled.
+running="$("$rt" inspect --format '{{.Image}}' "$("$rt" ps --filter "name=$SERVICE" --format '{{.Names}}' | head -1)" 2>/dev/null || true)"
+running="${running#sha256:}"
+if [ -n "$running" ] && [ "$running" != "$image" ]; then
+  echo "runway: the frontend is on ${image:0:12} and the backend is on ${running:0:12}." >&2
+  echo "        Not recording this as deployed, so the next run tries again." >&2
+  exit 1
+fi
 
 # Last, so that anything above failing means the next run tries again. A hand
 # rollback (see the README) leaves this pointing at the image you rolled away