diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d740775bcf..d1f4de8bfa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,6 +24,11 @@ on:
         required: false
         type: boolean
         default: false
+      ref:
+        description: "Reference of the commit to release (default: github.ref)"
+        required: false
+        type: string
+        default: ""
 
 env:
   CARGO_INCREMENTAL: 0
@@ -43,14 +48,13 @@ jobs:
     steps:
       - id: meta
         env:
-          SHA: ${{ github.sha }}
           VERSION: ${{ inputs.version }}
         shell: bash
         run: |
           set -euo pipefail
           shopt -s extglob
           if [[ '${{ github.event_name }}' == "pull_request" ]]; then
-            echo version="0.0.0-test.${SHA:0:7}"
+            echo version="0.0.0-test.${GITHUB_SHA:0:7}"
             echo archs='["amd64"]'
             exit 0
           fi >> "$GITHUB_OUTPUT"
@@ -78,6 +82,7 @@ jobs:
       version: ${{ steps.meta.outputs.version }}
       package: ${{ github.event_name == 'workflow_dispatch' || steps.changed.outputs.any_changed == 'true' }}
       profile: ${{ inputs.profile || 'release' }}
+      ref: ${{ inputs.ref || github.ref }}
 
   info:
     needs: meta
@@ -91,10 +96,12 @@ jobs:
           echo 'inputs.tag-prefix: ${{ inputs.tag-prefix }}'
           echo 'inputs.profile: ${{ inputs.profile }}'
           echo 'inputs.publish: ${{ inputs.publish }}'
+          echo 'inputs.ref: ${{ inputs.ref }}'
           echo 'needs.meta.outputs.archs: ${{ needs.meta.outputs.archs }}'
           echo 'needs.meta.outputs.version: ${{ needs.meta.outputs.version }}'
           echo 'needs.meta.outputs.package: ${{ needs.meta.outputs.package }}'
           echo 'needs.meta.outputs.profile: ${{ needs.meta.outputs.profile }}'
+          echo 'needs.meta.outputs.ref: ${{ needs.meta.outputs.ref }}'
 
   package:
     needs: meta
@@ -118,6 +125,8 @@ jobs:
       - name: Configure git
         run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
+        with:
+          ref: ${{ needs.meta.outputs.ref }}
       - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84
         with:
           key: ${{ matrix.libc }}
@@ -146,6 +155,8 @@ jobs:
           git config --global user.email 'github-actions[bot]@users.noreply.github.com'
       # Tag the release.
       - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
+        with:
+          ref: ${{ needs.meta.outputs.ref }}
       - run: git tag -a -m "v${{ needs.meta.outputs.version }}" "$TAG"
       # Fetch the artifacts.
       - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427