diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f90f41daf..1d6d4ca42 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -26,14 +26,15 @@ jobs:
       # Anything else is invalid.
       - name: Validate ref
         run: |
-          ref=${{ github.event.workflow_run.head_branch }}
-          sha=${{ github.event.workflow_run.head_sha }}
+          ref='${{ github.event.workflow_run.head_branch }}'
+          sha='${{ github.event.workflow_run.head_sha }}'
           case $ref in
             main)
               [ $(git branch --contains=$sha main | wc -l) -eq 1 ] &&
               [ $(git rev-list --count $sha..main) -le 2 ]
               ;;
             v?*)
+              [[ $ref =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] &&
               [ $(git rev-parse refs/tags/$ref) == $sha ] &&
               [ $(git branch --contains=$sha main | wc -l) -eq 1 ]
               ;;
@@ -49,7 +50,7 @@ jobs:
       - name: Compute tags
         id: tags
         run: |
-          ref=${{ github.event.workflow_run.head_branch }}
+          ref='${{ github.event.workflow_run.head_branch }}'
           case $ref in
             main)
               tags=("main" "edge")