diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 9907486..5655814 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -61,4 +61,5 @@ jobs:
           test "$(find release-assets -maxdepth 1 -name 'ragops-*.tar.gz' | wc -l)" -eq 1
           cp release-assets/ragops-*.whl release-assets/ragops-*.tar.gz dist/
       - name: Publish distributions with Trusted Publishing
-        uses: pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26 # v1.14.2
+        # Upstream container images are published for exact release tags, not commit-SHA refs.
+        uses: pypa/gh-action-pypi-publish@v1.14.2
diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py
index 0f063c0..7aaa2f1 100644
--- a/tests/test_github_workflows.py
+++ b/tests/test_github_workflows.py
@@ -9,7 +9,7 @@ def test_repository_has_consumer_ci_and_separate_release_publisher() -> None:
     assert "id-token: write" in workflow
     assert "environment: pypi" in workflow
     assert "pull_request" not in workflow
-    assert "pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26" in workflow
+    assert "pypa/gh-action-pypi-publish@v1.14.2" in workflow
     ci = (WORKFLOW_ROOT / "ci.yml").read_text(encoding="utf-8")
     assert "pull_request:" in ci
     assert 'python-version: ${{ matrix.python-version }}' in ci