diff --git a/scripts/cluster/run-production-acceptance.sh b/scripts/cluster/run-production-acceptance.sh
index 6b83bef..fb9546b 100755
--- a/scripts/cluster/run-production-acceptance.sh
+++ b/scripts/cluster/run-production-acceptance.sh
@@ -170,14 +170,25 @@ if [[ $skip_local_acceptance != true ]]; then
     exit 1
   }
 fi
-[[ $(git -C "$cluster_root" rev-parse HEAD) == "$release_sha" ]] || {
-  echo 'working copy HEAD must equal the release SHA' >&2
-  exit 1
-}
 [[ -z $(git -C "$cluster_root" status --short) ]] || {
   echo 'production acceptance requires a clean release working copy' >&2
   exit 1
 }
+acceptance_tool_sha=$(git -C "$cluster_root" rev-parse HEAD)
+if [[ $acceptance_tool_sha != "$release_sha" ]]; then
+  git -C "$cluster_root" merge-base --is-ancestor "$release_sha" "$acceptance_tool_sha" || {
+    echo 'production release must be an ancestor of the acceptance tool HEAD' >&2
+    exit 1
+  }
+  acceptance_tool_delta=$(node "$cluster_root/scripts/release-components.mjs" \
+    "$release_sha" "$acceptance_tool_sha")
+  [[ $(jq -r '.components' <<<"$acceptance_tool_delta") == none &&
+     $(jq -r '.migrationsChanged' <<<"$acceptance_tool_delta") == false ]] || {
+    echo 'acceptance tool HEAD contains runtime or migration changes beyond the production release' >&2
+    exit 1
+  }
+  echo "acceptance_tool_delta=PASS release=$release_sha tool_sha=$acceptance_tool_sha runtime_changes=false"
+fi
 
 namespace=${AI_GATEWAY_K3S_NAMESPACE:-easyai}
 remote_release_helper=${AI_GATEWAY_REMOTE_RELEASE_HELPER:-/usr/local/sbin/easyai-ai-gateway-cluster-release}