diff --git a/.github/scripts/previous-release-tag-test.py b/.github/scripts/previous-release-tag-test.py
new file mode 100644
index 00000000000..5b1465eef93
--- /dev/null
+++ b/.github/scripts/previous-release-tag-test.py
@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+# Copyright 2023 Greptime Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import importlib.util
+import subprocess
+import sys
+import unittest
+from pathlib import Path
+
+
+def load_module():
+    path = Path(__file__).resolve().parent / "previous-release-tag.py"
+    spec = importlib.util.spec_from_file_location("previous_release_tag", path)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+TAGS = [
+    "v1.1.0",
+    "v1.2.0",
+    "v1.2.1",
+    "v1.2.1^{}",
+    "v1.3.0-alpha.1",
+    "v1.3.0-beta.1",
+    "v1.3.0-beta.2",
+    "v1.2.0-nightly-20260706",
+]
+
+
+class PreviousReleaseTagTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.mod = load_module()
+
+    def test_beta_uses_latest_older_stable_not_an_ancestor(self) -> None:
+        self.assertEqual(self.mod.previous_stable_tag("v1.3.0-beta.2", TAGS), "v1.2.1")
+
+    def test_stable_release_skips_itself(self) -> None:
+        self.assertEqual(self.mod.previous_stable_tag("v1.2.1", TAGS), "v1.2.0")
+
+    def test_same_line_stable_is_not_baseline_for_its_prerelease(self) -> None:
+        tags = TAGS + ["v1.3.0"]
+        self.assertEqual(self.mod.previous_stable_tag("v1.3.0-beta.2", tags), "v1.2.1")
+        self.assertEqual(self.mod.previous_stable_tag("v1.3.0", tags), "v1.2.1")
+
+    def test_nightly_of_unreleased_version_uses_previous_stable(self) -> None:
+        self.assertEqual(
+            self.mod.previous_stable_tag("v1.3.0-nightly-20261013", TAGS),
+            "v1.2.1",
+        )
+
+    def test_no_older_stable_tag(self) -> None:
+        self.assertIsNone(self.mod.previous_stable_tag("v0.1.0", ["v0.1.0", "v1.2.1"]))
+
+    def test_invalid_version(self) -> None:
+        with self.assertRaises(ValueError):
+            self.mod.previous_stable_tag("nightly-20261013", TAGS)
+
+    def test_unordered_tags_use_numeric_order(self) -> None:
+        forward = ["v1.2.1", "v1.9.0", "v1.10.0", "v0.10.0", "v1.9.9"]
+        backward = list(reversed(forward))
+        for tags in (forward, backward):
+            self.assertEqual(self.mod.previous_stable_tag("v1.10.0", tags), "v1.9.9")
+            self.assertEqual(self.mod.previous_stable_tag("v1.10.0-rc.1", tags), "v1.9.9")
+
+    def test_multi_digit_components_compare_as_integers(self) -> None:
+        tags = ["v1.9.0", "v1.10.0", "v0.9.10", "v0.10.0", "v2.9.15", "v2.10.0", "v10.2.0"]
+        self.assertEqual(self.mod.previous_stable_tag("v1.10.0", tags), "v1.9.0")
+        self.assertEqual(self.mod.previous_stable_tag("v0.10.0", tags), "v0.9.10")
+        self.assertEqual(self.mod.previous_stable_tag("v2.10.0", tags), "v2.9.15")
+        self.assertEqual(self.mod.previous_stable_tag("v10.2.0", ["v10.0.9", "v9.20.0"]), "v10.0.9")
+
+
+class PreviousReleaseTagCliTest(unittest.TestCase):
+    SCRIPT = Path(__file__).resolve().parent / "previous-release-tag.py"
+
+    def run_cli(
+        self, version: str, tags: list[str] | None = None, stdin: str | None = None
+    ) -> subprocess.CompletedProcess[str]:
+        command = [sys.executable, str(self.SCRIPT), "--version", version]
+        if tags is not None:
+            command.extend(tags)
+        return subprocess.run(
+            command,
+            input=stdin,
+            text=True,
+            capture_output=True,
+            check=False,
+        )
+
+    def test_stdin_selects_baseline_and_exits_zero(self) -> None:
+        completed = self.run_cli(
+            "v1.10.0",
+            stdin="v1.2.1\nv1.9.0\n\nv1.10.0\nv1.9.0^{}\n",
+        )
+        self.assertEqual(completed.returncode, 0)
+        self.assertEqual(completed.stdout, "v1.9.0\n")
+        self.assertEqual(completed.stderr, "")
+
+    def test_positional_tags_ignore_stdin(self) -> None:
+        completed = self.run_cli("v1.10.0", tags=["v1.9.0"], stdin="v1.9.1\n")
+        self.assertEqual(completed.returncode, 0)
+        self.assertEqual(completed.stdout, "v1.9.0\n")
+
+    def test_no_older_tag_exits_zero_with_empty_stdout(self) -> None:
+        completed = self.run_cli("v0.1.0", stdin="v0.1.0\nv1.2.1\n")
+        self.assertEqual(completed.returncode, 0)
+        self.assertEqual(completed.stdout, "")
+        self.assertEqual(completed.stderr, "")
+
+    def test_invalid_version_exits_one(self) -> None:
+        completed = self.run_cli("nightly", stdin="v1.2.1\n")
+        self.assertEqual(completed.returncode, 1)
+        self.assertEqual(completed.stdout, "")
+        self.assertIn("not a release version: nightly", completed.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/scripts/previous-release-tag.py b/.github/scripts/previous-release-tag.py
new file mode 100644
index 00000000000..b8a8f42ef72
--- /dev/null
+++ b/.github/scripts/previous-release-tag.py
@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+# Copyright 2023 Greptime Team
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Pick the query-regression baseline tag for a release.
+
+Compatibility tests do not use this tag. They read ``tests/compatibility/ci.toml``.
+
+Release branches diverge, so a tag on ``release/v1.3`` is not a descendant of
+``v1.2.1``. Ancestry (``git tag --merged``) therefore skips the real previous
+release. Compare version numbers instead: the baseline is the greatest
+``vX.Y.Z`` tag whose version is strictly older than the release being built.
+Prerelease and nightly tags are not baselines.
+"""
+
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+
+STABLE_TAG = re.compile(r"^v(\d+)\.(\d+)\.(\d+)$")
+RELEASE_VERSION = re.compile(r"^v(\d+)\.(\d+)\.(\d+)(?:-.+)?$")
+
+
+def _triple(match: re.Match[str]) -> tuple[int, int, int]:
+    return int(match.group(1)), int(match.group(2)), int(match.group(3))
+
+
+def release_version(version: str) -> tuple[int, int, int]:
+    match = RELEASE_VERSION.fullmatch(version.strip())
+    if match is None:
+        raise ValueError(f"not a release version: {version}")
+    return _triple(match)
+
+
+def previous_stable_tag(version: str, tags: list[str]) -> str | None:
+    """Return the newest stable tag older than ``version``, or None."""
+    current = release_version(version)
+    best: tuple[int, int, int] | None = None
+    best_tag: str | None = None
+    for raw in tags:
+        tag = raw.strip()
+        if tag.endswith("^{}"):
+            tag = tag[: -len("^{}")]
+        match = STABLE_TAG.fullmatch(tag)
+        if match is None:
+            continue
+        triple = _triple(match)
+        if triple < current and (best is None or triple > best):
+            best = triple
+            best_tag = tag
+    return best_tag
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--version", required=True, help="Release version, e.g. v1.3.0-beta.2")
+    parser.add_argument(
+        "tags",
+        nargs="*",
+        help="Candidate tags. Read stdin when omitted.",
+    )
+    args = parser.parse_args(argv)
+    tags = list(args.tags)
+    if not tags and not sys.stdin.isatty():
+        tags = sys.stdin.read().splitlines()
+    try:
+        tag = previous_stable_tag(args.version, tags)
+    except ValueError as exc:
+        print(exc, file=sys.stderr)
+        return 1
+    if tag is None:
+        return 0
+    print(tag)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 2aa460ec0ca..030a8e2fcbb 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -82,6 +82,8 @@ jobs:
           version: "latest"
       - name: Run check-version script tests
         run: uv run --no-project python .github/scripts/check-version-test.py
+      - name: Run previous-release-tag script tests
+        run: python3 .github/scripts/previous-release-tag-test.py
       - name: Run enterprise license check tests
         run: python3 scripts/check-enterprise-license-test.py
       - name: Run fuzz orchestration script tests
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0fb22f23e61..a309c224568 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -415,11 +415,15 @@ jobs:
           REQUESTED_VALIDATION_POLICY: ${{ inputs.release_validation }}
         run: |
           set -euo pipefail
-          base_commit="${GITHUB_SHA}"
-          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
-            base_commit="${GITHUB_SHA}^"
-          fi
-          previous_release_tag="$(git tag --merged "${base_commit}" --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n 1 || true)"
+          # Stable tags on older release branches are not ancestors of this
+          # commit. Pick the newest vX.Y.Z older than the version being released.
+          release_version="${{ needs.allocate-runners.outputs.version }}"
+          previous_release_tag="$(
+            git ls-remote --tags origin 'refs/tags/v*' \
+              | awk '{print $2}' \
+              | sed -e 's#^refs/tags/##' \
+              | python3 .github/scripts/previous-release-tag.py --version "${release_version}"
+          )"
           if [[ -z "${previous_release_tag}" ]]; then
             previous_release_tag="main"
           fi