diff --git a/CLAUDE.md b/CLAUDE.md
index 7c196cb..13e53ff 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -28,9 +28,9 @@ live in `rain.factory` and arrive as the `rain-factory` Soldeer dependency
 
 - `src/generated/<tag>/` snapshots are **frozen**: a release ADDS a new tag dir,
   never edits or deletes an existing one. CI enforces append-only.
-- `[package].version` is the **last released** version — it names the current
-  `src/generated/<tag>/` snapshot. A normal PR does not bump it; only a release
-  moves it, in lockstep with the snapshot.
+- `[external.package].version` is the **last released** version — it names the
+  current `src/generated/<tag>/` snapshot. A normal PR does not bump it; only a
+  release moves it, in lockstep with the snapshot.
 - `LibCloneFactoryDeploy.sol` aliases the current tag's snapshot;
   `script/BuildPointers.sol` regenerates both. Generated files — do not
   hand-edit.
diff --git a/README.md b/README.md
index 25f1380..837efa3 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@ tagging: the `Manual sol artifacts` workflow runs `script/Deploy.sol` for the
 `clone-factory` suite. Tagging then runs `rainix-tag-release`, which never
 broadcasts a deploy itself; its mechanics live in rainix.
 
-Nothing publishes on merge, so `[package].version` and the frozen
+Nothing publishes on merge, so `[external.package].version` and the frozen
 `src/generated/<tag>/` snapshot it names only ever move together.
 
 See rainlanguage/rain.factory#46 for the split rationale.
diff --git a/foundry.toml b/foundry.toml
index 90e23b3..76f86b1 100644
--- a/foundry.toml
+++ b/foundry.toml
@@ -1,4 +1,12 @@
-[package]
+# Release metadata, not foundry config. `[external.*]` is the namespace foundry
+# reserves for other tools and ignores outright, so it raises no unknown-section
+# warning and `forge config --fix` leaves it alone (a section foundry does not
+# reserve is read as a profile, warned about on every invocation and rewritten
+# into `[profile.*]` by the fixer). `version` is the last-published Soldeer
+# release — a deploy repo moves it only via a manual `sol-v*` tag, in lockstep
+# with the frozen `src/generated/<tag>/` snapshot it names — and is read here by
+# `script/BuildPointers.sol` (`deployTag()`) to locate that snapshot.
+[external.package]
 name = "rain-factory-deploy"
 version = "0.1.5"
 
diff --git a/script/BuildPointers.sol b/script/BuildPointers.sol
index 5b5631e..a839511 100644
--- a/script/BuildPointers.sol
+++ b/script/BuildPointers.sol
@@ -32,10 +32,10 @@ contract BuildPointers is Script {
     // REUSE-IgnoreEnd
 
     /// @notice The canonical release tag. Read from `foundry.toml`
-    /// `[package].version` — the single source of truth — with dots converted to
-    /// underscores for the Solidity dir form (`0.1.3` -> `0_1_3`).
+    /// `[external.package].version` — the single source of truth — with dots
+    /// converted to underscores for the Solidity dir form (`0.1.3` -> `0_1_3`).
     function deployTag() internal view returns (string memory) {
-        string memory version = vm.parseTomlString(vm.readFile("foundry.toml"), ".package.version");
+        string memory version = vm.parseTomlString(vm.readFile("foundry.toml"), ".external.package.version");
         bytes memory b = bytes(version);
         bytes memory out = new bytes(b.length);
         for (uint256 i = 0; i < b.length; i++) {