diff --git a/backend/src/workspaces/registry.ts b/backend/src/workspaces/registry.ts
index 4e2038d5..0a36617e 100644
--- a/backend/src/workspaces/registry.ts
+++ b/backend/src/workspaces/registry.ts
@@ -439,9 +439,8 @@ export class WorkspaceRegistry {
         if (state.phase === "publication_intent_durable") {
           const activeBefore = await this.#tryActiveState();
           const activeDigest = activeBefore ? registryDigest(activeBefore) : undefined;
-          const baseAllowed = operation === "registry_bootstrap"
-            ? activeBefore === undefined
-            : (activeBefore !== undefined && activeBefore.head === state.baseCommit && activeDigest === state.baseManifestSha256);
+          const baseAllowed = activeBefore === undefined
+            || (operation === "registry_pull" && activeBefore.head === state.baseCommit && activeDigest === state.baseManifestSha256);
           const targetAllowed = activeBefore !== undefined && activeBefore.head === target && activeDigest === state.targetManifestSha256;
           if (!baseAllowed && !targetAllowed) throw new WorkspaceRegistryError("registry_bootstrap_recovery_conflict", "Active registry identity conflicts with addressed publication");
           if (targetAllowed) publication = operation === "registry_pull" && state.baseCommit === target ? "unchanged" : "reconciled_target";