diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 56524a8..592f28d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
       contents: write
       id-token: write
       attestations: write
-    uses: simtabi/.github/.github/workflows/go-release.yml@767e0c01251dbbfc695d03dfdd73db48733e852e  # v1.0.0
+    uses: simtabi/.github/.github/workflows/go-release.yml@b3388da3d08193ab1b757bc89e1707196da1ca76  # v0.1.0
     with:
       tag: ${{ inputs.tag || github.ref_name }}
       go-version-file: .go-version
diff --git a/CHANGELOG.md b/CHANGELOG.md
index aadfa2e..20c8bd2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Changed
 
-- `release.yml` calls simtabi/.github's shared `go-release.yml` at its `v1.0.0` release (`767e0c0`), pinned as `@<commit>  # v1.0.0` so Dependabot can advance the commit and the tag comment together. The release adds optional inputs only (`node-version` among them) and changes nothing a caller passes.
+- `release.yml` calls simtabi/.github's shared `go-release.yml` at its `v0.1.0` release (`b3388da`), pinned as `@<commit>  # v0.1.0` so Dependabot can advance the commit and the tag comment together. v0.1.0 replaces the withdrawn `v1.0.0` and `v1.0.1`: it adds optional inputs only (`node-version` among them), fetches every owned org's Go modules from git rather than proxy.golang.org, and changes nothing a caller passes.
 - `make check-build` asserts how many files it inspected in `build/`, not only that nothing is out of place: `make build` passes a floor of 2 (`targets.txt` and the binary) and `make cross` and `make dist` one per target plus `targets.txt` and `checksums.txt`, through `BUILD_LAYOUT_MIN`, so a check that reads an empty or wrong directory fails instead of passing.
 - Building probaci needs Go 1.26, and CI runs on it. Go 1.25 has ten standard-library
   vulnerabilities fixed only in 1.26, which the web UI's `net/http` server reaches; `golang.org/x/net`