diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a5d9380..854c760 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,7 @@ jobs:
       # is 'true'. Bundling and the GitHub release below still run on every tag.
       - name: Upload to PyPI (only whl + sdist)
         if: ${{ vars.PUBLISH_PYPI == 'true' }}
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         # At this point dist/ contains exactly *.whl + *.tar.gz. The
         # bundle + checksum file are written to bundle/ in the next
         # step so twine doesn't try to upload them.