diff --git a/tools/make-mirror.sh b/tools/make-mirror.sh
index 433f016..8478eed 100644
--- a/tools/make-mirror.sh
+++ b/tools/make-mirror.sh
@@ -11,8 +11,9 @@ cd "$(dirname "$0")/.."
 API=https://git.userevolt.app/api/v1/repos/esef/cs16-dm-server
 TAG=mods
 PY=$(command -v python3 || command -v python) || { echo "needs python3"; exit 1; }
-DIR=$(mktemp -d); trap 'rm -rf "$DIR"' EXIT
-CFG=$DIR/curl.cfg   # credentials go to curl through a file, not the command line
+# Two separate temp folders: only $DIR's files get uploaded, so the login must never be in it.
+DIR=$(mktemp -d); SEC=$(mktemp -d); trap 'rm -rf "$DIR" "$SEC"' EXIT
+CFG=$SEC/curl.cfg   # credentials go to curl through a file, not the command line
 umask 077
 if [ -n "$GITEA_TOKEN" ]; then
   printf 'header = "Authorization: token %s"\n' "$GITEA_TOKEN" > "$CFG"
@@ -39,7 +40,7 @@ cat tools/versions.txt tools/versions-windows.txt | tr -d '\r' | grep -v '^#' |
   done
 
 echo "== release '$TAG'"
-id=$(curl -fsS -K "$CFG" "$API/releases/tags/$TAG" 2>/dev/null | json "d['id']" || true)
+id=$(curl -fsS -K "$CFG" "$API/releases/tags/$TAG" 2>/dev/null | json "d['id']" 2>/dev/null || true)
 if [ -z "$id" ]; then
   body='Backup copies of the mod downloads, used by setup only when a main site is down. Every file is checked against tools/versions.txt before it is installed. Sources and licenses: ReHLDS, ReGameDLL_CS (MIT), Metamod-R, ReAPI, ReUnion (GPL-3.0) at github.com/rehlds; AMX Mod X (GPL-3.0) at github.com/alliedmodders/amxmodx; YaPB (Unlicense) at github.com/yapb/yapb.'
   id=$(printf '{"tag_name":"%s","target_commitish":"main","name":"Mod downloads (backup copies)","body":"%s"}' "$TAG" "$body" |
@@ -53,6 +54,8 @@ have=$(curl -fsS -K "$CFG" "$API/releases/$id/assets" | json "'\n'.join(a['name'
 echo "== uploading"
 for p in "$DIR"/*; do
   f=$(basename "$p")
+  # upload only files that are pinned in versions*.txt (and were hash-checked above)
+  grep -qE "^$f [0-9a-f]{64} " tools/versions.txt tools/versions-windows.txt || { echo "  skip $f (not a pinned file)"; continue; }
   if printf '%s\n' "$have" | grep -qxF "$f"; then echo "  have $f"; continue; fi
   curl -fsS -K "$CFG" -F "attachment=@$p" "$API/releases/$id/assets?name=$f" > /dev/null
   echo "  up   $f"