diff --git a/build.sh b/build.sh
index 0fc22b4d..62e107f3 100755
--- a/build.sh
+++ b/build.sh
@@ -1615,6 +1615,8 @@ EOF
     # manual key exchange. Public key is already in mother authorized_keys.
     _mother_key_src="/home/clawdie/.ssh/osa-mother-2026"
     if [ -f "${_mother_key_src}" ]; then
+        [ "${BUILD_CHANNEL}" = "release" ] && { echo "ERROR: refusing to bake mother SSH key into a release image"; exit 1; }
+
         mkdir -p "${MOUNT_POINT}/home/clawdie/.ssh"
         cp "${_mother_key_src}" "${MOUNT_POINT}/home/clawdie/.ssh/osa-mother-2026"
         chmod 0600 "${MOUNT_POINT}/home/clawdie/.ssh/osa-mother-2026"