sando: key gate evidence on the build, not the version string
sando: harden self-update against self-bricking