diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index ad66a2c..24cd967 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -87,13 +87,15 @@ jobs:
           Xvfb :99 -screen 0 1024x768x16 &
           sleep 1
           wineboot --init >/dev/null 2>&1 || true
-          # Pin Inno Setup version. Must match what innoextract on the
-          # runner image can unpack — innoextract 1.11 (latest in Debian
-          # trixie as of 2026-05) supports Inno Setup up to 6.4.x. Newer
-          # versions (6.5+, 6.7+) fail with "Setup loader checksum mismatch".
-          # When innoextract 1.12+ lands we can bump to 6.7.x.
-          INNO_VERSION="6.4.3"
-          INNO_TAG="is-6_4_3"
+          # Pin Inno Setup version. The innoextract package in Debian
+          # trixie (1.9.x) parses headers up through Inno Setup 6.2.x.
+          # 6.3+ already fails with "Unexpected setup data version" /
+          # "Stream error while parsing setup headers", 6.5+ with
+          # "Setup loader checksum mismatch". Stay on 6.2.2 until either
+          # innoextract gets bumped in Debian or we replace it with a
+          # docker-image-based ISCC step.
+          INNO_VERSION="6.2.2"
+          INNO_TAG="is-6_2_2"
           curl -fsSL -o /tmp/innosetup.exe \
             "https://github.com/jrsoftware/issrc/releases/download/${INNO_TAG}/innosetup-${INNO_VERSION}.exe"
           # innoextract unpacks the installer payload to ./app — that's the