diff --git a/.github/workflows/deploy-release.yml b/.github/workflows/deploy-release.yml
index eb4814943..daebc96b0 100644
--- a/.github/workflows/deploy-release.yml
+++ b/.github/workflows/deploy-release.yml
@@ -311,9 +311,14 @@ jobs:
             exit 1
           fi
 
-          if tag_json="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$release_tag" 2>/dev/null)"; then
-            tag_sha="$(jq -r '.object.sha' <<<"$tag_json")"
-            if [[ "$tag_sha" != "$release_sha" ]]; then
+          if tag_object="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$release_tag" \
+            --jq '.object | "\(.type) \(.sha)"' 2>/dev/null)"; then
+            read -r tag_type tag_sha <<<"$tag_object"
+            if [[ "$tag_type" == "tag" ]]; then
+              tag_object="$(gh api "repos/$GITHUB_REPOSITORY/git/tags/$tag_sha" --jq '.object | "\(.type) \(.sha)"')"
+              read -r tag_type tag_sha <<<"$tag_object"
+            fi
+            if [[ "$tag_type" != "commit" || "$tag_sha" != "$release_sha" ]]; then
               echo "Existing tag $release_tag resolves to $tag_sha instead of $release_sha" >&2
               exit 1
             fi
@@ -532,25 +537,24 @@ jobs:
         run: |
           set -euo pipefail
 
-          if tag_json="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$RELEASE_TAG" 2>/dev/null)"; then
-            tag_sha="$(jq -r '.object.sha' <<<"$tag_json")"
-            if [[ "$tag_sha" != "$RELEASE_SHA" ]]; then
-              echo "Existing tag $RELEASE_TAG resolves to $tag_sha instead of $RELEASE_SHA" >&2
-              exit 1
-            fi
-            echo "Existing tag $RELEASE_TAG already points to $RELEASE_SHA"
-          else
+          if ! gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$RELEASE_TAG" >/dev/null 2>&1; then
             gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \
               -f ref="refs/tags/$RELEASE_TAG" \
               -f sha="$RELEASE_SHA" >/dev/null
             echo "Created tag $RELEASE_TAG at $RELEASE_SHA"
           fi
 
-          created_sha="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$RELEASE_TAG" --jq '.object.sha')"
-          if [[ "$created_sha" != "$RELEASE_SHA" ]]; then
+          tag_object="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$RELEASE_TAG" --jq '.object | "\(.type) \(.sha)"')"
+          read -r tag_type created_sha <<<"$tag_object"
+          if [[ "$tag_type" == "tag" ]]; then
+            tag_object="$(gh api "repos/$GITHUB_REPOSITORY/git/tags/$created_sha" --jq '.object | "\(.type) \(.sha)"')"
+            read -r tag_type created_sha <<<"$tag_object"
+          fi
+          if [[ "$tag_type" != "commit" || "$created_sha" != "$RELEASE_SHA" ]]; then
             echo "Tag verification returned $created_sha instead of $RELEASE_SHA" >&2
             exit 1
           fi
+          echo "Verified tag $RELEASE_TAG at $RELEASE_SHA"
 
   publish_maven:
     name: Publish Maven
diff --git a/src/test/java/com/mcmoddev/basemetals/release/ReleaseDispatcherTest.java b/src/test/java/com/mcmoddev/basemetals/release/ReleaseDispatcherTest.java
index fddb0160f..412352be0 100644
--- a/src/test/java/com/mcmoddev/basemetals/release/ReleaseDispatcherTest.java
+++ b/src/test/java/com/mcmoddev/basemetals/release/ReleaseDispatcherTest.java
@@ -124,6 +124,21 @@ void requiresASuccessfulPriorBuild() throws Exception {
 		assertTrue(result.log.contains("no successful Build, test, and audit check"), result.log);
 	}
 
+	@Test
+	void resolvesAnnotatedReleaseTagsWithoutAcceptingWrongCommits() throws Exception {
+		final Map<String, String> environment = new LinkedHashMap<>();
+		environment.put("TEST_TAG_TYPE", "tag");
+		environment.put("TEST_TAG_TARGET", "0123456789012345678901234567890123456789");
+		final Map<String, String> properties = metadata("1.19.4", "forge", "17.0.1+12");
+		Result result = preflight("master-1.19.4", properties, environment);
+		assertEquals(0, result.exitCode, result.log);
+
+		environment.put("TEST_TAG_TARGET", "9876543210987654321098765432109876543210");
+		result = preflight("master-1.19.4", properties, environment);
+		assertTrue(result.exitCode != 0, result.log);
+		assertTrue(result.log.contains("instead of 0123456789012345678901234567890123456789"), result.log);
+	}
+
 	@Test
 	void refusesToReleaseFromAFork() throws Exception {
 		final Map<String, String> environment = new LinkedHashMap<>();
@@ -178,7 +193,9 @@ private Result preflight(final String branch, final Map<String, String> properti
 				+ " case \"$1 $2\" in\n"
 				+ "  \"api repos/$GITHUB_REPOSITORY/branches/$TEST_BRANCH\") return 0 ;;\n"
 				+ "  \"api repos/$GITHUB_REPOSITORY/commits/\"*\"/check-runs?per_page=100\") echo \"$TEST_CI_COUNT\" ;;\n"
-				+ "  \"api repos/$GITHUB_REPOSITORY/branches/\"*|\"api repos/$GITHUB_REPOSITORY/git/ref/tags/\"*) return 1 ;;\n"
+				+ "  \"api repos/$GITHUB_REPOSITORY/git/ref/tags/\"*) [[ -n \"${TEST_TAG_TYPE:-}\" ]] || return 1; echo \"$TEST_TAG_TYPE test-tag-object\" ;;\n"
+				+ "  \"api repos/$GITHUB_REPOSITORY/git/tags/test-tag-object\") echo \"commit $TEST_TAG_TARGET\" ;;\n"
+				+ "  \"api repos/$GITHUB_REPOSITORY/branches/\"*) return 1 ;;\n"
 				+ "  *) echo \"Unexpected GitHub call: $*\" >&2; return 99 ;;\n"
 				+ " esac\n}\n"
 				+ "git() { [[ \"$*\" == 'rev-parse HEAD' ]] || return 99; echo 0123456789012345678901234567890123456789; }\n";