diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ee2d030..7ceb5c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -176,7 +176,7 @@ jobs:
         # SHA-pinned (not the mutable release/v1 branch): this step runs with
         # id-token: write, so a compromised upstream ref could publish under our
         # OIDC identity. Dependabot (.github/dependabot.yml) bumps the pin.
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247  # v1.14.1
         with:
           # OIDC Trusted Publishing: no password — the id-token permission
           # above authenticates to PyPI. This REQUIRES a Trusted Publisher