workflow_run checks out the default branch head, which can drift past
the commit CI validated, so both jobs now check out the triggering SHA
and the release tags that commit rather than pushing a tag by hand.

Assisted-by: Claude Opus 5 via Claude Code

diff --git a/.github/dotslash-config.json b/.github/dotslash-config.json
new file mode 100644
index 0000000..ff9572e
--- /dev/null
+++ b/.github/dotslash-config.json
@@ -0,0 +1,12 @@
+{
+  "outputs": {
+    "frork": {
+      "platforms": {
+        "macos-aarch64": {
+          "regex": "^frork-aarch64-apple-darwin\\.tar\\.gz$",
+          "path": "frork"
+        }
+      }
+    }
+  }
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3b7e8c0..f4906fe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,14 +5,18 @@ on:
     branches: [main]
   pull_request:
 
+permissions: {}
+
 jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - run: rustup component add clippy rustfmt llvm-tools
       - run: cargo install grcov just
-      - uses: astral-sh/setup-uv@v6
-      - run: cargo fmt --check
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - run: cargo fmt --all --check
       - run: just clippy coverage
-      # - run: just mutants
+      # Mutation testing runs locally via `just mutants` — too slow for CI.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b8e717b..482082b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,8 +7,12 @@ on:
     types: [completed]
     branches: [main]
 
-permissions:
-  contents: write
+permissions: {}
+
+env:
+  # workflow_run checks out the default branch head by default, which may have
+  # moved past the commit CI actually validated.
+  RELEASE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
 
 jobs:
   build:
@@ -16,17 +20,21 @@ jobs:
       github.event_name == 'workflow_dispatch'
       || github.event.workflow_run.conclusion == 'success'
     runs-on: macos-latest
+    permissions:
+      contents: write # create GitHub release
+    outputs:
+      version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0
+          ref: ${{ env.RELEASE_SHA }}
+          persist-credentials: false
 
       - name: Calculate version
         id: version
         run: |
           CALVER=$(date -u +"%Y-%m-%d")
-          SHORT_SHA=$(git rev-parse --short HEAD)
-          echo "version=${CALVER}+${SHORT_SHA}" >> $GITHUB_OUTPUT
+          echo "version=${CALVER}+${RELEASE_SHA::7}" >> "$GITHUB_OUTPUT"
 
       - name: Build
         run: |
@@ -35,12 +43,31 @@ jobs:
 
       - name: Publish
         run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          git tag "v${VERSION}"
-          git push origin "v${VERSION}"
+          VERSION="${STEPS_VERSION_OUTPUTS_VERSION}"
           gh release create "v${VERSION}" \
             --title "v${VERSION}" \
             --generate-notes \
+            --target "${RELEASE_SHA}" \
             frork-aarch64-apple-darwin.tar.gz
         env:
           GH_TOKEN: ${{ github.token }}
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
+
+  dotslash:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # upload release assets
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ env.RELEASE_SHA }}
+          persist-credentials: false
+
+      - name: Generate DotSlash file
+        uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
+        with:
+          config: .github/dotslash-config.json
+          tag: v${{ needs.build.outputs.version }}
+        env:
+          GITHUB_TOKEN: ${{ github.token }}