diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 96ddb95..ea9439c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -61,7 +61,7 @@ jobs:
       # the image it pulls is still referenced by a moving ghcr tag, so a full pin
       # would require the ghcr digest — deferred (needs read:packages + release-time
       # validation). dependabot (github-actions) bumps this SHA.
-      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # release/v1
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # release/v1
         with:
           attestations: true