diff --git a/scripts/package-desktop-release.mjs b/scripts/package-desktop-release.mjs
index 7fdee03afb..a5dc207ab7 100644
--- a/scripts/package-desktop-release.mjs
+++ b/scripts/package-desktop-release.mjs
@@ -43,7 +43,7 @@ if (source === 'local') {
   const manifest = JSON.parse(readFileSync(join(webRoot, '.artifacts', `project-v${version}`, 'release-manifest.json'), 'utf8'))
   const commit = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim()
   if (manifest.version !== version || manifest.sourceCommit !== commit || manifest.sourceDirty) {
-    const changed = execFileSync('git', ['diff', '--name-only', '--ignore-submodules=dirty', 'HEAD', '--'], { cwd: root, encoding: 'utf8' }).trim()
+    const changed = execFileSync('git', ['diff', '--name-only', '--ignore-submodules=dirty', 'HEAD', '--', 'workdsh-web', 'upstream.json', 'deepseek-harness'], { cwd: root, encoding: 'utf8' }).trim()
     throw new Error(`The local Web release candidate is not a clean package of this commit: version=${manifest.version}/${version}, commit=${manifest.sourceCommit}/${commit}, sourceDirty=${manifest.sourceDirty}, changed=${changed || '(none)'}`)
   }
 }
diff --git a/workdsh-web/scripts/pack-project-release.mjs b/workdsh-web/scripts/pack-project-release.mjs
index 78d3bc276b..0852ce13e4 100644
--- a/workdsh-web/scripts/pack-project-release.mjs
+++ b/workdsh-web/scripts/pack-project-release.mjs
@@ -38,9 +38,9 @@ for (const directory of packageDirectories) {
 const sourceCommit = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' }).trim();
 let sourceDirty = false;
 try {
-  // Build tools may create untracked platform-specific files. A release is
-  // dirty only when committed source or the pinned submodule gitlink changes.
-  execFileSync('git', ['diff', '--quiet', '--ignore-submodules=dirty', 'HEAD', '--'], { cwd: root, stdio: 'ignore' });
+  // Desktop package checks regenerate a tracked Windows icon. Web release
+  // cleanliness covers the Web source and the DSH version inputs it consumes.
+  execFileSync('git', ['diff', '--quiet', '--ignore-submodules=dirty', 'HEAD', '--', 'workdsh-web', 'upstream.json', 'deepseek-harness'], { cwd: root, stdio: 'ignore' });
 } catch (error) {
   if (error.status !== 1) throw error;
   sourceDirty = true;