diff --git a/scripts/native/cicd/hwlab-node-control-plane-refresh.mjs b/scripts/native/cicd/hwlab-node-control-plane-refresh.mjs
index 95d9fb80..a590b6fd 100644
--- a/scripts/native/cicd/hwlab-node-control-plane-refresh.mjs
+++ b/scripts/native/cicd/hwlab-node-control-plane-refresh.mjs
@@ -302,6 +302,9 @@ function injectRuntimeGitopsGuard(pipeline) {
   const noBuildSkipPatched = script !== originalScript;
   const beforeInjection = script;
   script = injectRuntimeGitopsCommands(script);
+  if (hasNoBuildNoRolloutEarlyExit(script)) {
+    throw new Error("runtime GitOps guard injection failed: no-build-no-rollout-plan early exit remains after patch");
+  }
   const postprocessInjected = !beforeInjection.includes("runtime-gitops-postprocess.mjs") && script.includes("runtime-gitops-postprocess.mjs");
   const verifyInjected = !beforeInjection.includes("runtime-gitops-verify.mjs") && script.includes("runtime-gitops-verify.mjs");
   if (!script.includes("runtime-gitops-postprocess.mjs") || !script.includes("runtime-gitops-verify.mjs")) {
@@ -321,11 +324,15 @@ function injectRuntimeGitopsGuard(pipeline) {
 
 function patchNoBuildNoRolloutSkip(script) {
   return String(script).replace(
-    /(^|\n)([ \t]*)echo '\{"event":"gitops-promote","status":"skipped","reason":"no-build-no-rollout-plan"\}'\n[ \t]*exit 0(?=\n|$)/u,
-    (_match, prefix, indent) => `${prefix}${indent}echo '{"event":"gitops-promote","status":"continuing","reason":"no-build-no-rollout-plan-gitops-verify"}'`,
+    /(^|\n)([ \t]*)echo '\{"event":"gitops-promote","status":"skipped","reason":"no-build-no-rollout-plan"\}'(?:\s*>\s*&2)?\n[ \t]*exit 0(?=\n|$)/u,
+    (_match, prefix, indent) => `${prefix}${indent}echo '{"event":"gitops-promote","status":"continuing","reason":"no-build-no-rollout-plan-gitops-verify"}' >&2`,
   );
 }
 
+function hasNoBuildNoRolloutEarlyExit(script) {
+  return /echo '\{"event":"gitops-promote","status":"skipped","reason":"no-build-no-rollout-plan"\}'(?:\s*>\s*&2)?\n[ \t]*exit 0(?=\n|$)/u.test(String(script));
+}
+
 function injectRuntimeGitopsCommands(script) {
   if (script.includes("runtime-gitops-postprocess.mjs") && script.includes("runtime-gitops-verify.mjs")) return script;
   const overlayEnv = `UNIDESK_RUNTIME_GITOPS_OVERLAY_B64=${shellSingle(Buffer.from(JSON.stringify(overlay), "utf8").toString("base64"))}`;