diff --git a/.gitea/workflows/build-prod-android.yml b/.gitea/workflows/build-prod-android.yml
index 3770704..b17894a 100644
--- a/.gitea/workflows/build-prod-android.yml
+++ b/.gitea/workflows/build-prod-android.yml
@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 
diff --git a/.gitea/workflows/build-prod-commercial.yml b/.gitea/workflows/build-prod-commercial.yml
index 59134d1..75beb40 100644
--- a/.gitea/workflows/build-prod-commercial.yml
+++ b/.gitea/workflows/build-prod-commercial.yml
@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 
diff --git a/.gitea/workflows/build-prod-kiosk.yml b/.gitea/workflows/build-prod-kiosk.yml
index e5e89ef..94c72a6 100644
--- a/.gitea/workflows/build-prod-kiosk.yml
+++ b/.gitea/workflows/build-prod-kiosk.yml
@@ -17,6 +17,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod ISOs."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 
diff --git a/.gitea/workflows/build-prod-rpi.yml b/.gitea/workflows/build-prod-rpi.yml
index 609ac5e..34ba8bb 100644
--- a/.gitea/workflows/build-prod-rpi.yml
+++ b/.gitea/workflows/build-prod-rpi.yml
@@ -14,6 +14,17 @@ jobs:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
+      - name: Guard main branch is on the production channel
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          NAME=$(nix eval --impure --raw .#channelName)
+          if [ "$NAME" != "radiantwave" ]; then
+            echo "ERROR: main branch resolves to the '$NAME' channel, expected 'radiantwave'."
+            echo "       A dev->main merge brought a dev-pointing channel block into flake.nix."
+            echo "       Set channel.appInput/atticRepo/gitRef back to main values before building prod images."
+            exit 1
+          fi
+
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave
 
diff --git a/flake.lock b/flake.lock
index 8cbaeca..e77929b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -220,11 +220,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1787675420,
-        "narHash": "sha256-2Hq9IcgdDXQc2uQ4yC/5NZVjcZaFCcVS78vj+ee+y/Q=",
+        "lastModified": 1787953913,
+        "narHash": "sha256-6M0xyNIwhGiOiOyS+URYzhKdV69fRgifXYqoGmHrmaY=",
         "ref": "main",
-        "rev": "43cd93bbd7dde69c55c00a28c1691e1a192eda39",
-        "revCount": 47,
+        "rev": "fee31c87b8ece4bb025e7ec10aed03c9794e2143",
+        "revCount": 56,
         "type": "git",
         "url": "https://gitea.radiantwavetech.com/RadiantWaveTech/radiantwave.git"
       },
diff --git a/flake.nix b/flake.nix
index cbddecc..b3082c4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -68,11 +68,19 @@
       #
       # To flip branches, change ONLY these three values (then push/merge).
       channel = {
-        appInput = radiantwave-dev;                                    # dev
-        atticRepo = "radiantwave-dev";                                 # dev
-        gitRef = "?ref=dev";                                           # dev
+        appInput = radiantwave;                                        # main
+        atticRepo = "radiantwave";                                     # main
+        gitRef = "";                                                   # main
       };
 
+      # Exposed so CI (see .gitea/workflows/build-prod-*.yml) and humans can
+      # verify which channel this checkout resolves to. On `main` this must be
+      # "radiantwave"; on `dev` it must be "radiantwave-dev". The prod
+      # workflows fail fast if this isn't the production channel, so a merge
+      # that brings a dev-pointing channel block into `main` breaks the build
+      # instead of silently shipping dev builds as prod ISOs.
+      channelName = if channel.appInput == radiantwave then "radiantwave" else "radiantwave-dev";
+
       # Live app-update side channel. The manifest is served by the
       # fileserver; closures are fetched (never built) from the channel's
       # Attic cache. `repo` selects the channel — "radiantwave" (main) or
@@ -200,6 +208,8 @@
         };
     in
     {
+      inherit channelName;
+
       packages.x86_64-linux.radiantwavekiosk = self.nixosConfigurations.radiantwavekiosk.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-commercial = self.nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel;
       packages.x86_64-linux.radiantwavekiosk-android = self.nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel;