diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index b1ed2c3..9907486 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -61,4 +61,4 @@ jobs:
           test "$(find release-assets -maxdepth 1 -name 'ragops-*.tar.gz' | wc -l)" -eq 1
           cp release-assets/ragops-*.whl release-assets/ragops-*.tar.gz dist/
       - name: Publish distributions with Trusted Publishing
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26 # v1.14.2
diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py
index fbc18bb..0f063c0 100644
--- a/tests/test_github_workflows.py
+++ b/tests/test_github_workflows.py
@@ -9,6 +9,7 @@ def test_repository_has_consumer_ci_and_separate_release_publisher() -> None:
     assert "id-token: write" in workflow
     assert "environment: pypi" in workflow
     assert "pull_request" not in workflow
+    assert "pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26" in workflow
     ci = (WORKFLOW_ROOT / "ci.yml").read_text(encoding="utf-8")
     assert "pull_request:" in ci
     assert 'python-version: ${{ matrix.python-version }}' in ci