diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8b9fbcc..7a9d4b4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -123,7 +123,7 @@ jobs:
         with:
           name: ${{ needs.build.outputs.sha256-filename-darwin-arm64 }}
       - name: Install SLSA verifier
-        uses: slsa-framework/slsa-verifier/actions/installer@7e1e47d7d793930ab0082c15c2b971fdb53a3c95 # v2.4.1
+        uses: slsa-framework/slsa-verifier/actions/installer@v2.4.1 # Must specify version tag; see https://github.com/slsa-framework/slsa-verifier/issues/12
       - name: Verify SLSA provenance
         env:
           CHECKSUMS: ${{ needs.combine-checksums.outputs.checksums }}