diff --git a/.github/workflows/comment-release-fixes.yml b/.github/workflows/comment-release-fixes.yml
new file mode 100644
index 000000000..1376b1353
--- /dev/null
+++ b/.github/workflows/comment-release-fixes.yml
@@ -0,0 +1,24 @@
+name: comment release fixes
+on:
+  {
+    release: { types: [published] },
+    workflow_dispatch:
+      {
+        inputs:
+          {
+            tag: { required: true, type: string },
+            dry_run: { required: false, type: boolean, default: true },
+          },
+      },
+  }
+jobs:
+  comment:
+    permissions:
+      { contents: read, pull-requests: read, issues: write, discussions: write }
+    uses: jdx/workflows/.github/workflows/comment-release-fixes.yml@4c952564543dd54d60f15ef4062af7fb60c5561d
+    with:
+      {
+        tag: "${{ inputs.tag || github.event.release.tag_name }}",
+        marker_prefix: usage-fixed-in,
+        dry_run: "${{ inputs.dry_run || false }}",
+      }
diff --git a/.github/workflows/perf-pr.yml b/.github/workflows/perf-pr.yml
index 1434bccb9..a6af8928e 100644
--- a/.github/workflows/perf-pr.yml
+++ b/.github/workflows/perf-pr.yml
@@ -230,7 +230,7 @@ jobs:
           cp /tmp/shadow-report.md /tmp/tak-out/shadow.md 2>/dev/null || true
           printf '%s %s\n' "${HEAD_SHA:0:12}" "${BASE_SHA:0:12}" > /tmp/tak-out/shas
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: tak-report
@@ -259,7 +259,7 @@ jobs:
       checks: write # attach the regression gate to the measured PR head SHA
       pull-requests: write # the sticky comment, and nothing else
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: tak-report
           path: /tmp/tak-out
diff --git a/.github/workflows/perf.yml b/.github/workflows/perf.yml
index 45f991a04..847421136 100644
--- a/.github/workflows/perf.yml
+++ b/.github/workflows/perf.yml
@@ -98,7 +98,7 @@ jobs:
           git notes --ref=tak show HEAD > /tmp/tak-out/note
           git rev-parse HEAD > /tmp/tak-out/sha
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: github.ref == 'refs/heads/main'
         with:
           name: tak-measurement
@@ -118,7 +118,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: tak-measurement
           path: /tmp/tak-out
diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml
index 3a0a114b8..2ba2bab8f 100644
--- a/.github/workflows/publish-cli.yml
+++ b/.github/workflows/publish-cli.yml
@@ -370,3 +370,16 @@ jobs:
   #       with:
   #         token: ${{ secrets.GH_BOT_TOKEN }}
   #         formula: usage
+
+  comment-release-fixes:
+    needs: release
+    if: ${{ !cancelled() && needs.release.result == 'success' && startsWith(github.ref, 'refs/tags/v') }}
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: write
+      discussions: write
+    uses: jdx/workflows/.github/workflows/comment-release-fixes.yml@4c952564543dd54d60f15ef4062af7fb60c5561d
+    with:
+      tag: ${{ github.ref_name }}
+      marker_prefix: usage-fixed-in