diff --git a/argocd/manifests/shower/kustomization.yaml b/argocd/manifests/shower/kustomization.yaml
index 0afc8e3..d2ce83c 100644
--- a/argocd/manifests/shower/kustomization.yaml
+++ b/argocd/manifests/shower/kustomization.yaml
@@ -14,4 +14,4 @@ resources:
 
 images:
   - name: registry.ops.eblu.me/blumeops/shower
-    newTag: v1.0.2-039d9b9-nix
+    newTag: v1.0.2-292d354-nix
diff --git a/docs/changelog.d/+shower-main-sha-rebuild.infra.md b/docs/changelog.d/+shower-main-sha-rebuild.infra.md
new file mode 100644
index 0000000..f1751b5
--- /dev/null
+++ b/docs/changelog.d/+shower-main-sha-rebuild.infra.md
@@ -0,0 +1,5 @@
+Rebuild shower from the post-merge commit on main so the container's
+SHA tag points at a commit that will still exist after the 30-day
+branch-cleanup window. Functionally identical to the branch-tag image
+already deployed, just preserves source traceability per
+[[build-container-image#Squash-merge and container tags]].