diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 1fd298b..df582cd 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -64,8 +64,8 @@ publishers:
     env:
       - APP_PASSWORD={{ .Env.APP_PASSWORD }}
       - TANGLED_REPO_DID={{ .Env.TANGLED_REPO_DID }}
+      - TANGLED_REF_NAME={{ .Env.TANGLED_REF_NAME }}
       - REPO_URL={{ .Env.REPO_URL }}
-      - TAG={{ .Tag }}
       - ARTIFACT_PATH={{ abs .ArtifactPath }}
       - ARTIFACT_NAME={{ .ArtifactName }}
 
diff --git a/.tangled/workflows/release-credential-helper.yml b/.tangled/workflows/release-credential-helper.yml
index aeccd2c..f533317 100644
--- a/.tangled/workflows/release-credential-helper.yml
+++ b/.tangled/workflows/release-credential-helper.yml
@@ -22,12 +22,15 @@ environment:
 steps:
   - name: Install tools
     command: |
+      set -e
       go install github.com/bluesky-social/goat@latest
-      go install github.com/goreleaser/goreleaser/v2@latest
-      apt-get update && apt-get install -y jq xxd
+      # goreleaser v2.14+ requires Go 1.26.1; pin to a version compatible with the image's Go 1.25.
+      go install github.com/goreleaser/goreleaser/v2@v2.13.3
 
   - name: Build and publish release
     command: |
+      set -e
+      export PATH="$(go env GOPATH)/bin:$PATH"
       git fetch --tags
 
       # REPO_URL is built from Tangled-provided env vars
diff --git a/scripts/publish-artifact.sh b/scripts/publish-artifact.sh
index 55cd8e5..1ca6915 100755
--- a/scripts/publish-artifact.sh
+++ b/scripts/publish-artifact.sh
@@ -1,20 +1,22 @@
 #!/usr/bin/env bash
 set -e
 goat account login -u "${TANGLED_REPO_DID}" -p "${APP_PASSWORD}"
-TAG_HASH=$(git rev-parse "$TAG") &&
-TAG_BYTES=$(echo -n "$TAG_HASH" | xxd -r -p | base64 | tr -d '=') &&
-BLOB_OUTPUT=$(goat blob upload "$ARTIFACT_PATH") &&
-echo "$BLOB_OUTPUT" &&
-ARTIFACT_JSON=$(echo "$BLOB_OUTPUT" | jq --arg tag "$TAG_BYTES" --arg name "$ARTIFACT_NAME" --arg repo "$REPO_URL" --arg created "$(date -Iseconds)" '{
-    "tag": {"$bytes": $tag},
-    "name": $name,
-    "repo": $repo,
-    "$type": "sh.tangled.repo.artifact",
-    "artifact": .,
-    "createdAt": $created
-  }') &&
-echo "$ARTIFACT_JSON" > temp_artifact.json &&
-cat temp_artifact.json &&
+TAG_HASH=$(git rev-parse "$TANGLED_REF_NAME")
+TAG_BYTES=$(printf "$(printf '%s' "$TAG_HASH" | sed 's/../\\x&/g')" | base64 | tr -d '=')
+BLOB_OUTPUT=$(goat blob upload "$ARTIFACT_PATH")
+echo "$BLOB_OUTPUT"
+CREATED_AT=$(date -Iseconds)
+cat > temp_artifact.json <<EOF
+{
+  "\$type": "sh.tangled.repo.artifact",
+  "tag": {"\$bytes": "${TAG_BYTES}"},
+  "name": "${ARTIFACT_NAME}",
+  "repo": "${REPO_URL}",
+  "artifact": ${BLOB_OUTPUT},
+  "createdAt": "${CREATED_AT}"
+}
+EOF
+cat temp_artifact.json
 goat record create temp_artifact.json -n
 rm temp_artifact.json
-sleep 2
\ No newline at end of file
+sleep 2