diff --git a/runner/harness/abra.py b/runner/harness/abra.py
index 8873efb..6d7be0b 100644
--- a/runner/harness/abra.py
+++ b/runner/harness/abra.py
@@ -47,11 +47,14 @@ def _run(args: list[str], timeout: int = 300, check: bool = True) -> subprocess.
 def app_new(recipe: str, domain: str, server: str = "default", version: Optional[str] = None,
             secrets: bool = False) -> None:
     args = ["app", "new", recipe]
+    args += ["-s", server, "-D", domain, "-o", "-n"]
     if version:
+        # pin to a published version tag (e.g. upgrade's previous-version deploy) — a clean tag
+        # checkout, which is incompatible with chaos.
         args.append(version)
-    # -C (chaos): deploy the recipe AT THE CURRENT CHECKOUT (the PR head under test), not a
-    # re-resolved version tag. -o (offline): don't fetch tags from the (private) remote.
-    args += ["-s", server, "-D", domain, "-C", "-o", "-n"]
+    else:
+        # -C (chaos): deploy the recipe AT THE CURRENT CHECKOUT (the PR head under test).
+        args.append("-C")
     if secrets:
         args.append("-S")
     _run(args)