diff --git a/.gitea/workflows/docker.yml b/.gitea/workflows/docker.yml
index b2422c9..cf1a243 100644
--- a/.gitea/workflows/docker.yml
+++ b/.gitea/workflows/docker.yml
@@ -234,6 +234,22 @@ jobs:
             echo "${SERVICE_CONTAINER} is already running; leaving it alone so nothing"
             echo "in flight is interrupted. Re-run with refresh_service=true to move it"
             echo "onto the image just built."
+            # ...but say so loudly, because "left alone" and "up to date" look
+            # identical from outside and the gap only widens. This cost a whole
+            # debugging session once: the container had been up for six hours on
+            # the previous build, so the feature added in between simply was not
+            # there, and every symptom pointed at the new code instead.
+            built=$(docker image inspect "$image" --format '{{.Id}}')
+            current=$(docker inspect "${SERVICE_CONTAINER}" --format '{{.Image}}')
+            if [ "$built" != "$current" ]; then
+              echo "::warning::${SERVICE_CONTAINER} is running ${current#sha256:} but the"
+              echo "::warning::image just built is ${built#sha256:} -- it is STALE."
+              echo "STALE=yes" >> "$GITHUB_ENV"
+              echo "STALE_RUNNING=${current#sha256:}" >> "$GITHUB_ENV"
+              echo "STALE_BUILT=${built#sha256:}" >> "$GITHUB_ENV"
+            else
+              echo "${SERVICE_CONTAINER} is already on the image just built."
+            fi
           else
             docker rm -f "${SERVICE_CONTAINER}" >/dev/null 2>&1 || true
             docker run -d \
@@ -259,6 +275,19 @@ jobs:
           {
             echo "### lean-bench image"
             echo ""
+            if [ "${STALE:-}" = "yes" ]; then
+              echo "> **The \`${SERVICE_CONTAINER}\` container is stale.** It is still"
+              echo "> running \`${STALE_RUNNING:0:12}\`; this build produced"
+              echo "> \`${STALE_BUILT:0:12}\`. It was left alone on purpose so that"
+              echo "> nothing in flight was interrupted, so anything you exec into it"
+              echo "> runs the OLD code. Re-run this workflow with"
+              echo "> \`refresh_service=true\` once the runner is idle, or:"
+              echo "> \`\`\`"
+              echo "> docker rm -f ${SERVICE_CONTAINER}"
+              echo "> \`\`\`"
+              echo "> and re-run to have it recreated."
+              echo ""
+            fi
             echo "Kept on the runner (not cleaned up):"
             for tag in ${{ steps.meta.outputs.local_tags }}; do echo "- \`$tag\`"; done
             echo ""