@@ -20,6 +20,9 @@ paths:
   ".github/workflows/release-cuda-pathfinder.yml":
     ignore:
       - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
+  ".github/workflows/release.yml":
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
   ".github/workflows/test-wheel-linux.yml":
     ignore:
       - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
 
@@ -165,7 +165,9 @@ jobs:
           ref: ${{ inputs.git-tag }}
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        # $/ resolves at the workflow's commit. ./ would resolve against the
+        # release tag checkout, which can predate this action.
+        uses: $/.github/actions/setup-hardened-python
         with:
           python-version: "3.12"