diff --git a/scripts/create-release-manifest.sh b/scripts/create-release-manifest.sh
index 309286d9..b2c147b2 100755
--- a/scripts/create-release-manifest.sh
+++ b/scripts/create-release-manifest.sh
@@ -99,16 +99,19 @@ if [ -z "$FRONTEND_ARCHIVE" ]; then
                 cp -r "$PROJECT_ROOT/$runtime_path" "$RUNTIME_DIR/$runtime_path"
             fi
         done
-        if [ -f "$PROJECT_ROOT/image-recipe/configs/archipelago-doctor.service" ] || \
-           [ -f "$PROJECT_ROOT/image-recipe/configs/archipelago-doctor.timer" ]; then
-            mkdir -p "$RUNTIME_DIR/image-recipe/configs"
-            for unit in archipelago-doctor.service archipelago-doctor.timer; do
-                if [ -f "$PROJECT_ROOT/image-recipe/configs/$unit" ]; then
-                    echo "  Including runtime unit $unit"
-                    cp "$PROJECT_ROOT/image-recipe/configs/$unit" "$RUNTIME_DIR/image-recipe/configs/$unit"
-                fi
-            done
-        fi
+        # KEEP IN SYNC with the `for unit in [...]` array in
+        # core/archipelago/src/bootstrap.rs (run_runtime_assets). A unit that
+        # bootstrap installs but this list does not ship simply never reaches a
+        # node: bootstrap looks for it in the runtime payload, does not find
+        # it, and silently installs nothing. There is no error to notice.
+        mkdir -p "$RUNTIME_DIR/image-recipe/configs"
+        for unit in archipelago-doctor.service archipelago-doctor.timer \
+                    archipelago-host-secrets-audit.service; do
+            if [ -f "$PROJECT_ROOT/image-recipe/configs/$unit" ]; then
+                echo "  Including runtime unit $unit"
+                cp "$PROJECT_ROOT/image-recipe/configs/$unit" "$RUNTIME_DIR/image-recipe/configs/$unit"
+            fi
+        done
         if [ -f "$PROJECT_ROOT/image-recipe/configs/nginx-archipelago.conf" ]; then
             mkdir -p "$RUNTIME_DIR/image-recipe/configs"
             echo "  Including runtime nginx-archipelago.conf"