diff --git a/.github/workflows/template-update.yml b/.github/workflows/template-update.yml
index 45809fb..4ae5798 100644
--- a/.github/workflows/template-update.yml
+++ b/.github/workflows/template-update.yml
@@ -150,7 +150,14 @@ jobs:
           git checkout -b "$BRANCH"
           git add -A
           git commit -m "chore: apply template updates from $REF"
-          git push --force-with-lease \
+          # The push goes to a URL rather than to `origin`, so a bare
+          # --force-with-lease has no remote-tracking ref to compare against
+          # and refuses with "stale info" whenever the branch already exists,
+          # which is every week after a run that pushed but couldn't open its
+          # PR. Lease against what checkout fetched instead; empty means the
+          # branch must not exist yet.
+          expect=$(git rev-parse -q --verify "refs/remotes/origin/$BRANCH" || true)
+          git push --force-with-lease="$BRANCH:$expect" \
             "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "$BRANCH"
 
           BODY="Applied by \`copier update --vcs-ref $REF\`."
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 97ebfe5..b42f8e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ### Fixed
 
+- `template-update.yml` no longer fails every run once its update branch
+  exists. It pushed with a bare `--force-with-lease` to a URL, which gives git
+  no remote-tracking ref to lease against, so the push was refused with
+  `stale info` whenever the branch was already there. A run that pushed but
+  couldn't open its PR left every later run failing. The push now leases
+  against the branch as checkout fetched it, so it still refuses to overwrite
+  a commit pushed during the run.
 - `bump-v1.yml` annotates the release tag before moving `v1` onto the same
   commit. With both tags lightweight, copier read the template's version as
   `1`, so the weekly template update rewrote consumers' `_commit` to `v1`