diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 113db20..cf31ad5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,9 +50,14 @@ jobs:
           uv build
           python scripts/check_source_boundary.py --require-dist
 
+      # Pinned to a commit SHA, not the floating release/v1 tag, so an upstream
+      # change cannot alter a release with no commit here. v1.14.2 bundles twine
+      # 7.0.0 and packaging 26.2, which accept the Metadata-Version 2.5 that current
+      # hatchling emits. v1.14.0 rejected it and broke the openadapt-evals 0.91.0
+      # publish after the tag had already landed.
       - name: Publish to PyPI
         if: steps.check_skip.outputs.skip != 'true' && steps.release.outputs.released == 'true'
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
 
       - name: Publish to GitHub Releases
         if: steps.check_skip.outputs.skip != 'true' && steps.release.outputs.released == 'true'