diff --git a/buildscripts/verify-rebrand.sh b/buildscripts/verify-rebrand.sh
index 56802d297..92236c4a0 100755
--- a/buildscripts/verify-rebrand.sh
+++ b/buildscripts/verify-rebrand.sh
@@ -135,11 +135,28 @@ if rg -n 'pgsty/minio:' .github/workflows Dockerfile.goreleaser helm/silo; then
 	fail "an active delivery surface still publishes the frozen pgsty/minio image"
 fi
 
-# The repository and its default branch are pgsty/silo and main. Only three
-# places may still name the old repository, and each one exists to reject or
-# freeze it rather than to point users at it: the pinned pre-rebrand image
-# digest in the upgrade test, and the two guards that refuse a legacy image.
-repo_guard_allowlist='^(buildscripts/minio-upgrade\.sh|buildscripts/verify-rebrand\.sh|buildscripts/helm-migration-guard/main\.go):'
+# The repository and its default branch are pgsty/silo and main. The invariant
+# is that the old name is never a live target, not that it is never spoken: the
+# READMEs have to name it to explain the rename and to point at the archived
+# artifacts, which is the opposite of stranding a reader on it.
+#
+# So two rules. First, no live URL may resolve to the old repository anywhere,
+# READMEs included.
+stale_repo_url="$(rg -n -e 'github\.com/pgsty/minio' -e 'hub\.docker\.com/r/pgsty/minio' \
+	--glob '!.git/**' --glob '!dist/**' \
+	--glob '!SILO_REBRANDING_MIGRATION.md' \
+	--glob '!buildscripts/rebrand-guard/compat-baseline.json' . |
+	sed 's#^\./##' | grep -v '^buildscripts/verify-rebrand\.sh:' || true)"
+if [ -n "${stale_repo_url}" ]; then
+	printf '%s\n' "${stale_repo_url}" >&2
+	fail "a link still resolves to the pre-rename pgsty/minio repository"
+fi
+
+# Second, the bare name may only appear where it is deliberate: the pinned
+# pre-rebrand image digest in the upgrade test, the two guards that refuse a
+# legacy image, and the two READMEs that document the rename and the archived
+# minio branch.
+repo_guard_allowlist='^(buildscripts/minio-upgrade\.sh|buildscripts/verify-rebrand\.sh|buildscripts/helm-migration-guard/main\.go|README\.md|README_ZH\.md):'
 stale_repo="$(rg -n 'pgsty/minio' --glob '!.git/**' --glob '!dist/**' \
 	--glob '!SILO_REBRANDING_MIGRATION.md' \
 	--glob '!buildscripts/rebrand-guard/compat-baseline.json' . |