diff --git a/README.md b/README.md
index 6242bacb..e52d8d07 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ all three runtimes and the artifact versions used for the run.
 The qualified tuple in
 [`polyglot/qualified-artifact-tuple.json`](polyglot/qualified-artifact-tuple.json)
 pins every published artifact the journeys use: native Durable Workflow Server
-3.0.2 (by image digest), Workflow 2.17.1, Waterline 2.13.2, PHP SDK 3.8.1,
+3.0.4 (by image digest), Workflow 2.17.1, Waterline 2.13.2, PHP SDK 3.8.1,
 Python SDK 2.13.0, Rust SDK 4.10.3 and CLI 2.3.3. `artifacts.workflow` selects
 the embedded application's Composer package; the Composer lock must match it.
 Native Server is one process that creates its schema and `default` namespace
diff --git a/polyglot/qualified-artifact-tuple.json b/polyglot/qualified-artifact-tuple.json
index 940fbf59..cdc71a03 100644
--- a/polyglot/qualified-artifact-tuple.json
+++ b/polyglot/qualified-artifact-tuple.json
@@ -2,13 +2,13 @@
   "schema": "durable-workflow.sample-app.polyglot-qualified-artifact-tuple",
   "schemaVersion": 1,
   "source": "polyglot/qualified-artifact-tuple.json",
-  "serverImage": "durableworkflow/server:3.0.2@sha256:4be918deb2fc5e3fc2ee51d1afa3045eb9aebe490637f0d92bfdba3b8f50af50",
+  "serverImage": "durableworkflow/server:3.0.4@sha256:013010476b78f37038ac09d9498a95cdbf5ae7896111c321b2d4a2aac2f81f6b",
   "artifacts": {
     "cli": "2.3.3",
     "sdk-php": "3.8.1",
     "sdk-python": "2.13.0",
     "sdk-rust": "4.10.3",
-    "server": "3.0.2",
+    "server": "3.0.4",
     "waterline": "2.13.2",
     "workflow": "2.17.1"
   }
diff --git a/scripts/sdk-activity-recovery.sh b/scripts/sdk-activity-recovery.sh
index 166a4fb4..4a7ec776 100755
--- a/scripts/sdk-activity-recovery.sh
+++ b/scripts/sdk-activity-recovery.sh
@@ -68,7 +68,14 @@ docker image inspect "$DURABLE_SERVER_IMAGE" > "$result_dir/server-image.json"
 docker image inspect "${COMPOSE_PROJECT_NAME}-php-sdk-worker:latest" "${COMPOSE_PROJECT_NAME}-rust-workflow-worker:latest" \
   "${COMPOSE_PROJECT_NAME}-smoke:latest" > "$result_dir/consumer-images.json"
 # Native images carry their release tag; they embed no Workflow package.
-[[ "$(docker image inspect "$DURABLE_SERVER_IMAGE" --format '{{index .Config.Labels "dev.durable-workflow.release.tag"}}')" == "native-$DURABLE_SERVER_VERSION" ]]
+# Releases through 3.0.2 were tagged native-X.Y.Z; later ones use plain X.Y.Z
+# (durable-workflow/server#972).
+server_release_tag="$(docker image inspect "$DURABLE_SERVER_IMAGE" --format '{{index .Config.Labels "dev.durable-workflow.release.tag"}}')"
+if [[ "$server_release_tag" != "$DURABLE_SERVER_VERSION" && "$server_release_tag" != "native-$DURABLE_SERVER_VERSION" ]]; then
+  printf 'Server image release tag %s does not match the qualified Server %s.\n' \
+    "${server_release_tag:-<missing>}" "$DURABLE_SERVER_VERSION" >&2
+  exit 1
+fi
 
 observer() {
   "${compose[@]}" run --rm --no-deps --user "$ACTIVITY_RECOVERY_UID:$ACTIVITY_RECOVERY_GID" -T \