diff --git a/.github/workflows/dependabot-sync-actions-comments.yml b/.github/workflows/dependabot-sync-actions-comments.yml
index ba27a4c..49729db 100644
--- a/.github/workflows/dependabot-sync-actions-comments.yml
+++ b/.github/workflows/dependabot-sync-actions-comments.yml
@@ -156,8 +156,8 @@ jobs:
           // lead-in / version token / rest-of-line (verbatim, carries any annotations).
           export const PIN_LINE_RE = /^(\s*(?:-\s+)?uses:\s+)([\w.-]+\/[\w./-]+)@([0-9a-f]{40})(\s+#\s*)(v?\d[^\s#]*)(.*)$/;
 
-          // Tags eligible as version comments: v-optional dotted numerics with an
-          // optional prerelease suffix.
+          // Tags eligible as version comments: v-optional dotted numerics with
+          // optional prerelease and build-metadata suffixes (SemVer §9–10).
           export const TAG_RE = /^v?\d+(\.\d+){0,2}(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
 
           const LS_REMOTE_LINE_RE = /^([0-9a-f]{40})\trefs\/tags\/([^\s^]+)(\^\{\})?$/;
@@ -583,12 +583,12 @@ jobs:
           # The PR API can lag the just-completed branch push by a few seconds;
           # poll until the reported head catches up before judging. Mismatch
           # after the window still refuses to arm.
-          for _ in 1 2 3 4 5 6; do
+          for attempt in 1 2 3 4 5 6; do
             prs="$(gh pr list --repo "$GITHUB_REPOSITORY" --state open --head "$REPAIR_BRANCH" \
               --json number,headRefOid,baseRefName,author)"
             [ "$(jq 'length' <<<"$prs")" = "1" ] && \
               [ "$(jq -r '.[0].headRefOid' <<<"$prs")" = "$NEW_HEAD" ] && break
-            sleep 5
+            [ "$attempt" = "6" ] || sleep 5
           done
           if [ "$(jq 'length' <<<"$prs")" != "1" ]; then
             echo "::error::expected exactly one open repair PR after create/update"
diff --git a/scripts/sync-action-pin-comments.mjs b/scripts/sync-action-pin-comments.mjs
index 979be6d..7de2058 100644
--- a/scripts/sync-action-pin-comments.mjs
+++ b/scripts/sync-action-pin-comments.mjs
@@ -35,8 +35,8 @@ const execFileAsync = promisify(execFile);
 // lead-in / version token / rest-of-line (verbatim, carries any annotations).
 export const PIN_LINE_RE = /^(\s*(?:-\s+)?uses:\s+)([\w.-]+\/[\w./-]+)@([0-9a-f]{40})(\s+#\s*)(v?\d[^\s#]*)(.*)$/;
 
-// Tags eligible as version comments: v-optional dotted numerics with an
-// optional prerelease suffix.
+// Tags eligible as version comments: v-optional dotted numerics with
+// optional prerelease and build-metadata suffixes (SemVer §9–10).
 export const TAG_RE = /^v?\d+(\.\d+){0,2}(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
 
 const LS_REMOTE_LINE_RE = /^([0-9a-f]{40})\trefs\/tags\/([^\s^]+)(\^\{\})?$/;