diff --git a/actions/nextcloud-appstore-publish/action.yml b/actions/nextcloud-appstore-publish/action.yml
index 3f66b68..e6fc21d 100644
--- a/actions/nextcloud-appstore-publish/action.yml
+++ b/actions/nextcloud-appstore-publish/action.yml
@@ -41,7 +41,7 @@ runs:
   using: composite
   steps:
     - name: Check actor permission
-      uses: LibreCodeCoop/release-tool/actions/authorization-check@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+      uses: LibreCodeCoop/release-tool/actions/authorization-check@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
         github-token: ${{ inputs.github-token }}
         repository: ${{ github.repository }}
@@ -79,7 +79,7 @@ runs:
 
     - name: Validate release identity
       id: release_identity
-      uses: LibreCodeCoop/release-tool/actions/release-identity@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+      uses: LibreCodeCoop/release-tool/actions/release-identity@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
         tag: ${{ inputs.release-tag }}
         working-directory: ${{ inputs.app-name }}
@@ -87,7 +87,7 @@ runs:
 
     - name: Inspect application build metadata
       id: build_metadata
-      uses: LibreCodeCoop/release-tool/actions/build-inspect@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+      uses: LibreCodeCoop/release-tool/actions/build-inspect@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
         root: ${{ inputs.app-name }}
 
@@ -255,16 +255,8 @@ runs:
         cd "${APP_NAME}/build/artifacts"
         tar -zcvf "${APP_NAME}.tar.gz" "${APP_NAME}"
 
-    - name: Set up PHP 8.3 for release-tool
-      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
-      with:
-        php-version: '8.3'
-        coverage: none
-      env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
-
     - name: Validate release artifact
-      uses: LibreCodeCoop/release-tool/actions/artifact-validate@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+      uses: LibreCodeCoop/release-tool/actions/artifact-validate@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
         artifact: ${{ inputs.app-name }}/build/artifacts/${{ inputs.app-name }}.tar.gz
         app-name: ${{ inputs.app-name }}
@@ -293,7 +285,7 @@ runs:
         app_private_key: ${{ inputs.app-private-key }}
 
     - name: Verify App Store publication
-      uses: LibreCodeCoop/release-tool/actions/appstore-publication-wait@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+      uses: LibreCodeCoop/release-tool/actions/appstore-publication-wait@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
         app-name: ${{ inputs.app-name }}
         version: ${{ steps.release_identity.outputs.version }}
diff --git a/tests/test_appstore_publication_contract.py b/tests/test_appstore_publication_contract.py
index 8d1ee0f..f853665 100644
--- a/tests/test_appstore_publication_contract.py
+++ b/tests/test_appstore_publication_contract.py
@@ -26,7 +26,7 @@ def test_owned_template_is_not_regenerated_from_upstream(self) -> None:
 
     def test_consumer_template_is_thin_wrapper(self) -> None:
         content = TEMPLATE.read_text(encoding="utf-8")
-        self.assertIn("LibreCodeCoop/.github/actions/nextcloud-appstore-publish@600b84354bdbb2da4fc32e9d4eecac1fcce60666", content)
+        self.assertRegex(content, r"uses: LibreCodeCoop/\.github/actions/nextcloud-appstore-publish@[0-9a-f]{40}")
         self.assertNotIn("\n        run: |", content)
         self.assertLessEqual(len(content.splitlines()), 40)
 
diff --git a/tests/test_release_tool_pins.py b/tests/test_release_tool_pins.py
index 73f916b..736bf90 100644
--- a/tests/test_release_tool_pins.py
+++ b/tests/test_release_tool_pins.py
@@ -7,7 +7,7 @@
 
 
 ROOT = Path(__file__).resolve().parents[1]
-RELEASE_TOOL_RELEASE_SHA = "30ba5d8a33089331d829f586546d34cd45a529d7"
+RELEASE_TOOL_RELEASE_SHA = "51355769089a6796c23d6c966108afbdaf858c32"
 SURFACES = (
     ROOT / "workflow-templates/prepare-release.yml",
     ROOT / "workflow-templates/nightly-release.yml",
@@ -22,6 +22,11 @@ def test_prepare_release_keeps_trusted_pipeline_contract(self) -> None:
         self.assertIn("post-merge-event: pull_request_target", content)
         self.assertIn('git fetch --quiet origin "+refs/heads/main:refs/remotes/origin/main"', content)
 
+    def test_publisher_does_not_enforce_latest_release_at_runtime(self) -> None:
+        content = (ROOT / "actions/nextcloud-appstore-publish/action.yml").read_text(encoding="utf-8")
+        self.assertNotIn("Verify publisher action matches current catalog", content)
+        self.assertNotIn("repos/LibreCodeCoop/release-tool/releases/latest", content)
+
     def test_release_tool_consumers_use_same_release(self) -> None:
         for path in SURFACES:
             content = path.read_text(encoding="utf-8")
diff --git a/tests/test_release_workflow_architecture.py b/tests/test_release_workflow_architecture.py
index 1f90a3a..e6173d0 100644
--- a/tests/test_release_workflow_architecture.py
+++ b/tests/test_release_workflow_architecture.py
@@ -43,6 +43,14 @@ def test_prepare_release_preserves_privileged_event_guards(self) -> None:
         self.assertIn("contains(github.event.pull_request.body, '<!-- release-tool:preparation ')", content)
         self.assertNotIn("paths-ignore:", content)
 
+    def test_publisher_preserves_app_php_until_release_tool_validation(self) -> None:
+        content = PUBLISH.read_text()
+        self.assertIn("php-version: ${{ steps.php_versions.outputs.php-min }}", content)
+        self.assertNotIn("name: Set up PHP 8.5 for release-tool", content)
+        signing = content.index("php nextcloud/occ integrity:sign-app")
+        validation = content.index("uses: LibreCodeCoop/release-tool/actions/artifact-validate@")
+        self.assertLess(signing, validation)
+
     def test_action_pins_are_immutable(self) -> None:
         for path in (NIGHTLY, PUBLISH, PREPARE):
             with self.subTest(file=path.name):
diff --git a/workflow-templates/appstore-build-publish.yml b/workflow-templates/appstore-build-publish.yml
index 7a42936..efd77be 100644
--- a/workflow-templates/appstore-build-publish.yml
+++ b/workflow-templates/appstore-build-publish.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Build and publish release
-        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@600b84354bdbb2da4fc32e9d4eecac1fcce60666 # main at 600b843
+        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@8828d1047c31ac1c6bf1998436b2a73e7e5c6288 # PHP 8.5 publisher
         with:
           app-name: ${{ github.event.repository.name }}
           release-tag: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}
diff --git a/workflow-templates/nightly-release.yml b/workflow-templates/nightly-release.yml
index bead5b3..c446f00 100644
--- a/workflow-templates/nightly-release.yml
+++ b/workflow-templates/nightly-release.yml
@@ -29,7 +29,7 @@ jobs:
     steps:
       - id: stable
         name: Resolve stable release line
-        uses: LibreCodeCoop/release-tool/actions/stable-select@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/stable-select@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           github-token: ${{ github.token }}
 
@@ -62,7 +62,7 @@ jobs:
 
       - name: Inspect checked-out stable metadata
         id: build_metadata
-        uses: LibreCodeCoop/release-tool/actions/build-inspect@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/build-inspect@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           root: ${{ env.APP_NAME }}
 
@@ -196,7 +196,7 @@ jobs:
           tar -zcf "${APP_NAME}.tar.gz" "${APP_NAME}"
 
       - name: Validate release artifact
-        uses: LibreCodeCoop/release-tool/actions/artifact-validate@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/artifact-validate@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           artifact: ${{ env.APP_NAME }}/build/artifacts/${{ env.APP_NAME }}.tar.gz
           app-name: ${{ env.APP_NAME }}
@@ -222,7 +222,7 @@ jobs:
 
       - name: Build nightly change list
         id: release-note-changes
-        uses: LibreCodeCoop/release-tool/actions/release-notes@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/release-notes@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           repository: ${{ github.repository }}
           branch: ${{ steps.nightly.outputs.branch }}
diff --git a/workflow-templates/prepare-release.yml b/workflow-templates/prepare-release.yml
index d35aec1..b618005 100644
--- a/workflow-templates/prepare-release.yml
+++ b/workflow-templates/prepare-release.yml
@@ -87,7 +87,7 @@ jobs:
           git fetch --quiet origin "+refs/heads/main:refs/remotes/origin/main"
 
       - name: Prepare release
-        uses: LibreCodeCoop/release-tool/actions/prepare@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/prepare@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           branch: ${{ inputs.branch }}
           ref: ${{ inputs.ref }}
@@ -132,7 +132,7 @@ jobs:
           git fetch --quiet --unshallow --prune origin             "+refs/heads/${RELEASE_BRANCH}:refs/remotes/origin/${RELEASE_BRANCH}"             "+refs/tags/*:refs/tags/*"
 
       - name: Finalize merged release
-        uses: LibreCodeCoop/release-tool/actions/post-merge@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/post-merge@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           pull-request-number: ${{ github.event.pull_request.number }}
           merger: ${{ github.event.pull_request.merged_by.login }}
@@ -158,7 +158,7 @@ jobs:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Verify publication
-        uses: LibreCodeCoop/release-tool/actions/publication@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/publication@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           github-release-id: ${{ github.event.release.id }}
           config-path: .nextcloud-release.yml