diff --git a/scripts/provision-repo.sh b/scripts/provision-repo.sh
index c20bea3..b9712c6 100755
--- a/scripts/provision-repo.sh
+++ b/scripts/provision-repo.sh
@@ -23,8 +23,31 @@ if [[ ! "$REPO_NAME" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]]; then
   exit 1
 fi
 
-WORKFLOW_VERSION=$(gh api "repos/${ORG}/.github/tags?per_page=100" \
-  --jq '[.[] | select(.name | test("^v[0-9]+\\.[0-9]+\\.[0-9]+$"))][0].name // empty')
+# GitHub returns tags by recency; compare semantic versions explicitly.
+WORKFLOW_TAGS=$(gh api --paginate "repos/${ORG}/.github/tags?per_page=100" \
+  --jq '.[] | select(.name | test("^v[0-9]+\\.[0-9]+\\.[0-9]+$")) | .name')
+WORKFLOW_VERSION=""
+WORKFLOW_MAJOR=-1
+WORKFLOW_MINOR=-1
+WORKFLOW_PATCH=-1
+while IFS= read -r tag; do
+  [[ -z "$tag" ]] && continue
+
+  if [[ "$tag" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+    major=$((10#${BASH_REMATCH[1]}))
+    minor=$((10#${BASH_REMATCH[2]}))
+    patch=$((10#${BASH_REMATCH[3]}))
+
+    if (( major > WORKFLOW_MAJOR || \
+      (major == WORKFLOW_MAJOR && minor > WORKFLOW_MINOR) || \
+      (major == WORKFLOW_MAJOR && minor == WORKFLOW_MINOR && patch > WORKFLOW_PATCH) )); then
+      WORKFLOW_VERSION="$tag"
+      WORKFLOW_MAJOR="$major"
+      WORKFLOW_MINOR="$minor"
+      WORKFLOW_PATCH="$patch"
+    fi
+  fi
+done <<< "$WORKFLOW_TAGS"
 if [[ -z "$WORKFLOW_VERSION" ]]; then
   echo "Error: no released Sea-Haven-Industries/.github vX.Y.Z tag found."
   exit 1