diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 86328ae..91418d7 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -28,7 +28,7 @@ on:
 env:
   # A called workflow arrives without its repository. Keep this literal pin
   # aligned with the ceremony release consumed by callers (issue #9 D3).
-  CEREMONY_SELF_REF: "0.4.0"
+  CEREMONY_SELF_REF: "fda5657285ad32e2f0ff9465c6701f0833f7e8fa"
 
 jobs:
   scope:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 556b841..a3d0f7e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -129,7 +129,7 @@ env:
   # `ref:` accepts ${{ env }}; `uses:` strings do not — which is why the
   # shared logic arrives as script files via checkout, not as inner `uses:`
   # references.
-  CEREMONY_SELF_REF: "0.4.0"
+  CEREMONY_SELF_REF: "fda5657285ad32e2f0ff9465c6701f0833f7e8fa"
   VERSION_SOURCE: ${{ inputs.version-source }}
 
 jobs: