diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 288aecc..f58abca 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -162,8 +162,7 @@ jobs:
           fi
 
           EXISTING="$(curl -sf -H "$AUTH" "$API/releases/$RELEASE_ID/assets" \
-            | python3 -c 'import json,sys; print("\n".join(a["name"] for a in json.load(sys.stdin)))' \
-            || true)"
+            || echo '[]')"
           for FILE in desktop/release/*"$VERSION"*.deb \
                       desktop/release/*"$VERSION"*.pkg.tar.zst \
                       desktop/release/latest-linux.yml \
@@ -172,11 +171,25 @@ jobs:
                       desktop/release/*"$VERSION"*.exe.blockmap; do
             [ -e "$FILE" ] || continue
             NAME="$(basename "$FILE")"
-            case "$EXISTING" in
-              *"$NAME"*) echo "    already attached: $NAME"; continue ;;
-            esac
-            echo "    attaching $NAME"
+            # Replace the asset when it is already there: latest*.yml must
+            # reference the installers built by *this* run (NSIS builds are
+            # not bit-reproducible), so old copies are deleted first.
+            ASSET_ID="$(printf '%s' "$EXISTING" | python3 -c '
+          import json, sys
+          name = sys.argv[1]
+          print(next((str(a["id"]) for a in json.load(sys.stdin) if a["name"] == name), ""))
+          ' "$NAME")"
+            if [ -n "$ASSET_ID" ]; then
+              echo "    replacing $NAME"
+              curl -sf -X DELETE -H "$AUTH" \
+                "$API/releases/$RELEASE_ID/assets/$ASSET_ID" >/dev/null
+            else
+              echo "    attaching $NAME"
+            fi
+            # Names like "J621 Setup 0.1.1.exe" contain spaces: encode them
+            # or curl refuses the URL (exit 3).
+            ENCODED="$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "$NAME")"
             curl -sf -X POST -H "$AUTH" -H "Content-Type: application/octet-stream" \
-              --data-binary @"$FILE" "$API/releases/$RELEASE_ID/assets?name=$NAME" >/dev/null
+              --data-binary @"$FILE" "$API/releases/$RELEASE_ID/assets?name=$ENCODED" >/dev/null
           done
           echo "Release: ${{ github.server_url }}/${{ github.repository }}/releases/tag/$TAG"