diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index 9c14e74..722b45c 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -280,14 +280,14 @@ jobs:
 
       - name: Publish to TestPyPI
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_target == 'testpypi' }}
-        uses: pypa/gh-action-pypi-publish@4bb033805d9e19112d8c697528791ff53f6c2f74
+        uses: pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26 # v1.14.2
         with:
           packages-dir: dist
           repository-url: https://test.pypi.org/legacy/
 
       - name: Publish to PyPI
         if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || (github.event_name == 'workflow_dispatch' && inputs.publish_target == 'pypi') }}
-        uses: pypa/gh-action-pypi-publish@4bb033805d9e19112d8c697528791ff53f6c2f74
+        uses: pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26 # v1.14.2
         with:
           packages-dir: dist
 
diff --git a/README.md b/README.md
index f9fd70a..da2d9bc 100644
--- a/README.md
+++ b/README.md
@@ -7,9 +7,9 @@
 
 | Version | License | Install | Release notes |
 | --- | --- | --- | --- |
-| `0.4.3` | [Apache-2.0](LICENSE) | `python -m pip install base-cli` | [v0.4.3](https://github.com/basefoundry/base-cli/releases/tag/v0.4.3) |
+| `0.5.0` | [Apache-2.0](LICENSE) | `python -m pip install base-cli` | [v0.5.0](https://github.com/basefoundry/base-cli/releases/tag/v0.5.0) |
 
-Source release candidate: 0.5.0. Publication is pending the [release checklist](docs/release-0.5.0-checklist.md); PyPI remains the authority for available versions.
+The 0.5.0 release is bound to the immutable `v0.5.0` tag; PyPI remains the authority for available versions.
 The adopter documentation uses `~=0.5.0` for the release-preparation target;
 use that pin only after the 0.5.0 artifact is published and verified.