diff --git a/.github/workflows/bundle-deploy-eas-update.yml b/.github/workflows/bundle-deploy-eas-update.yml
index 7899b62269..d4e18cc510 100644
--- a/.github/workflows/bundle-deploy-eas-update.yml
+++ b/.github/workflows/bundle-deploy-eas-update.yml
@@ -225,31 +225,6 @@ jobs:
           SENTRY_DIST=${{ steps.env.outputs.bundle-identifier }}
           pnpm export
 
-      # Pin ONE bundle version for both publishes below. Each script used to call
-      # `date +%s` itself, so the same bytes reached denis and ota1 under versions
-      # seconds apart (observed: 1785102575 vs 1785102614). The version is part of
-      # the asset URL path, so each origin then served a manifest referencing a
-      # path only it had -- meaning a manifest fetched from one origin and assets
-      # fetched from the other 404. Both scripts fall back to `date +%s` when this
-      # is unset, so single-publisher callers are unaffected.
-      - name: 🔢 Pin bundle version
-        if: ${{ !steps.fingerprint.outputs.includes-changes &&
-          !steps.version.outputs.version-changed }}
-        run: echo "BUNDLE_VERSION=$(date +%s)" >> "$GITHUB_ENV"
-
-      # denis on EKS has been the sole origin for updates.bsky.app since
-      # 2026-07-26, so it publishes FIRST: it is the path that actually serves
-      # clients. The legacy ota1 upload runs after it, and exists only so that
-      # rolling the Bunny origin back to ota1 would find current bundles there.
-      #
-      # The ordering is load-bearing, not cosmetic. While the legacy step ran
-      # first, its failure skipped these steps and nothing reached EITHER origin
-      # -- the dual-write took down the working path with it. Both steps are
-      # still required to pass, so a stale ota1 remains a loud failure, but the
-      # publish that serves users has already landed before the legacy one can
-      # fail.
-      #
-      # Both halves are removed together when ota1 is decommissioned (Phase 5).
       - name: ☁️ Configure AWS credentials (denis)
         if: ${{ !steps.fingerprint.outputs.includes-changes &&
           !steps.version.outputs.version-changed }}
@@ -279,19 +254,6 @@ jobs:
           BSKY_IOS_BUILD_NUMBER: ${{ inputs.iosBuildNumber }}
           BSKY_ANDROID_VERSION_CODE: ${{ inputs.androidVersionCode }}
 
-      - name: 📦 Package Bundle and 🚀 Deploy (legacy ota1)
-        if: ${{ !steps.fingerprint.outputs.includes-changes &&
-          !steps.version.outputs.version-changed }}
-        run: pnpm use-build-number bash scripts/bundleUpdate.sh
-        env:
-          DENIS_API_KEY: ${{ secrets.DENIS_API_KEY }}
-          RUNTIME_VERSION: ${{ inputs.runtimeVersion }}
-          CHANNEL_NAME: ${{ inputs.channel || 'testflight' }}
-          # When set (required for production), these take precedence over the
-          # global EAS counters inside the use-build-number wrapper
-          BSKY_IOS_BUILD_NUMBER: ${{ inputs.iosBuildNumber }}
-          BSKY_ANDROID_VERSION_CODE: ${{ inputs.androidVersionCode }}
-
   buildIfNecessaryIOS:
     name: Build and Submit iOS
     needs: [bundleDeploy]
diff --git a/package.json b/package.json
index 3ae22dc51a..861f9fa5f7 100644
--- a/package.json
+++ b/package.json
@@ -93,7 +93,6 @@
     "update-extensions": "bash scripts/updateExtensions.sh",
     "export": "expo export --dump-sourcemap && pnpm upload-native-sourcemaps",
     "upload-native-sourcemaps": "pnpm exec sentry-expo-upload-sourcemaps dist",
-    "make-deploy-bundle": "bash scripts/bundleUpdate.sh",
     "generate-webpack-stats-file": "EXPO_PUBLIC_GENERATE_STATS=1 pnpm build-web",
     "open-analyzer": "EXPO_PUBLIC_OPEN_ANALYZER=1 pnpm build-web",
     "icons:optimize": "svgo -f ./assets/icons",
diff --git a/scripts/bundleUpdate.sh b/scripts/bundleUpdate.sh
deleted file mode 100644
index 35bed14ed0..0000000000
--- a/scripts/bundleUpdate.sh
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/bin/bash
-set -o errexit
-set -o pipefail
-set -o nounset
-
-rm -rf bundleTempDir
-rm -rf bundle.tar.gz
-
-echo "Creating tarball..."
-node scripts/bundleUpdate.js
-
-if [ -z "$RUNTIME_VERSION" ]; then
-  RUNTIME_VERSION=$(cat package.json | jq '.version' -r)
-fi
-
-cd bundleTempDir || exit
-
-# Shared with denisPublish.sh when both run in one job -- see the note there.
-# Both origins must receive the same bundle version for the same bytes, because
-# the version is part of the asset URL path.
-BUNDLE_VERSION="${BUNDLE_VERSION:-$(date +%s)}"
-
-# This MUST address ota1's own origin hostname, never updates.bsky.app.
-#
-# Since the 2026-07-26 cutover updates.bsky.app resolves to denis on EKS, which
-# deliberately has no /v1/upload route -- publishing there is out-of-band via
-# `denis publish` (see denisPublish.sh). Posting to the CDN hostname therefore
-# returns 404, which is what broke this step the first time it ran after the
-# flip. The dual-write was never independent of the cutover precisely because it
-# addressed the hostname being cut over.
-#
-# This upload exists only to keep ota1 carrying current bundles so a rollback of
-# the Bunny origin remains useful. It goes away with this whole script when ota1
-# is decommissioned (Phase 5).
-OTA1_ORIGIN="${OTA1_ORIGIN:-https://ota1.us-east.updates.bsky.network}"
-DEPLOYMENT_URL="$OTA1_ORIGIN/v1/upload?runtime-version=$RUNTIME_VERSION&bundle-version=$BUNDLE_VERSION&channel=$CHANNEL_NAME&ios-build-number=$BSKY_IOS_BUILD_NUMBER&android-build-number=$BSKY_ANDROID_VERSION_CODE"
-
-tar czvf bundle.tar.gz ./*
-
-echo "Deploying to $DEPLOYMENT_URL..."
-echo "  runtime-version: $RUNTIME_VERSION"
-echo "  bundle-version: $BUNDLE_VERSION"
-echo "  channel: $CHANNEL_NAME"
-echo "  ios-build-number: $BSKY_IOS_BUILD_NUMBER"
-echo "  android-build-number: $BSKY_ANDROID_VERSION_CODE"
-
-curl --fail-with-body -o - --form "bundle=@./bundle.tar.gz" --user "bsky:$DENIS_API_KEY" --basic "$DEPLOYMENT_URL"
-
-cd ..
-
-rm -rf bundleTempDir
-rm -rf bundle.tar.gz
diff --git a/scripts/denisPublish.sh b/scripts/denisPublish.sh
index c6a30b77b9..2b4624eca0 100755
--- a/scripts/denisPublish.sh
+++ b/scripts/denisPublish.sh
@@ -4,8 +4,7 @@ set -o pipefail
 set -o nounset
 
 # Publishes the just-exported Expo bundle to the denis OTA service (S3) via the
-# `denis publish` CLI. Mirrors bundleUpdate.sh's inputs (runtime version, bundle
-# version, build numbers) but targets denis instead of the legacy ota1 upload.
+# `denis publish` CLI.
 # Expects: the `denis` binary on PATH (setup-denis action), ambient AWS creds
 # (configure-aws-credentials OIDC), and BSKY_IOS_BUILD_NUMBER /
 # BSKY_ANDROID_VERSION_CODE from the use-build-number wrapper.
@@ -19,16 +18,7 @@ if [ -z "$RUNTIME_VERSION" ]; then
   RUNTIME_VERSION=$(cat package.json | jq '.version' -r)
 fi
 
-# Accept a caller-supplied bundle version so that a dual-write publishes the SAME
-# version to every origin. When this script and bundleUpdate.sh each called
-# `date +%s` independently they produced versions seconds apart for identical
-# bytes -- observed 1785102575 (denis) vs 1785102614 (ota1) for one commit. Since
-# the version is part of the asset URL path, the two origins then served
-# manifests pointing at paths only one of them had, so the manifest and its
-# assets had to come from the same origin or the fetch 404s. Falling back to
-# `date +%s` keeps standalone callers (PR previews, `pnpm make-deploy-bundle`)
-# working unchanged.
-BUNDLE_VERSION="${BUNDLE_VERSION:-$(date +%s)}"
+BUNDLE_VERSION=$(date +%s)
 DENIS_CDN_DOMAIN="${DENIS_CDN_DOMAIN:-updates.bsky.app}"
 DENIS_S3_BUCKET="${DENIS_S3_BUCKET:-bsky-denis-ota-prod}"