diff --git a/actions/nextcloud-appstore-publish/action.yml b/actions/nextcloud-appstore-publish/action.yml
index 64df956..40b43b1 100644
--- a/actions/nextcloud-appstore-publish/action.yml
+++ b/actions/nextcloud-appstore-publish/action.yml
@@ -77,7 +77,7 @@ runs:
 
     - name: Validate release identity
       id: release_identity
-      uses: LibreCodeCoop/release-tool/actions/release-identity@d83c79f61a5a46322e105e7d84cf8e8a151d2085
+      uses: LibreCodeCoop/release-tool/actions/release-identity@40e17457fe28003e5893bf55e3c2102c965ddb8c
       with:
         tag: ${{ inputs.release-tag }}
         working-directory: ${{ inputs.app-name }}
@@ -271,7 +271,7 @@ runs:
         GITHUB_TOKEN: ${{ inputs.github-token }}
 
     - name: Validate release artifact
-      uses: LibreCodeCoop/release-tool/actions/artifact-validate@d83c79f61a5a46322e105e7d84cf8e8a151d2085
+      uses: LibreCodeCoop/release-tool/actions/artifact-validate@40e17457fe28003e5893bf55e3c2102c965ddb8c
       with:
         artifact: ${{ inputs.app-name }}/build/artifacts/${{ inputs.app-name }}.tar.gz
         app-name: ${{ inputs.app-name }}
@@ -300,7 +300,7 @@ runs:
         app_private_key: ${{ inputs.app-private-key }}
 
     - name: Verify App Store publication
-      uses: LibreCodeCoop/release-tool/actions/appstore-publication-wait@d83c79f61a5a46322e105e7d84cf8e8a151d2085
+      uses: LibreCodeCoop/release-tool/actions/appstore-publication-wait@40e17457fe28003e5893bf55e3c2102c965ddb8c
       with:
         app-name: ${{ inputs.app-name }}
         version: ${{ steps.release_identity.outputs.version }}
diff --git a/tests/test_release_tool_pins.py b/tests/test_release_tool_pins.py
new file mode 100644
index 0000000..db918fd
--- /dev/null
+++ b/tests/test_release_tool_pins.py
@@ -0,0 +1,35 @@
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+import re
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+RELEASE_TOOL_RELEASE_SHA = "40e17457fe28003e5893bf55e3c2102c965ddb8c"
+SURFACES = (
+    ROOT / "workflow-templates/prepare-release.yml",
+    ROOT / "workflow-templates/nightly-release.yml",
+    ROOT / "actions/nextcloud-appstore-publish/action.yml",
+)
+
+
+class ReleaseToolPinsTest(unittest.TestCase):
+    def test_release_tool_consumers_use_same_release(self) -> None:
+        for path in SURFACES:
+            content = path.read_text(encoding="utf-8")
+            revisions = re.findall(
+                r"LibreCodeCoop/release-tool/[^@\s]+@([0-9a-f]{40})",
+                content,
+            )
+            self.assertTrue(revisions, msg=f"No release-tool pin found in {path}")
+            self.assertEqual(
+                {RELEASE_TOOL_RELEASE_SHA},
+                set(revisions),
+                msg=f"{path} is not aligned with the organization release-tool pin",
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/workflow-templates/nightly-release.yml b/workflow-templates/nightly-release.yml
index bae9bd6..ff39757 100644
--- a/workflow-templates/nightly-release.yml
+++ b/workflow-templates/nightly-release.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       - id: stable
         name: Resolve stable release line
-        uses: LibreCodeCoop/release-tool/actions/stable-select@710c4c83fba47bf01713f46e9c4cb4cf63debfba
+        uses: LibreCodeCoop/release-tool/actions/stable-select@40e17457fe28003e5893bf55e3c2102c965ddb8c
         with:
           github-token: ${{ github.token }}
 
@@ -215,7 +215,7 @@ jobs:
           tar -zcf "${APP_NAME}.tar.gz" "${APP_NAME}"
 
       - name: Validate release artifact
-        uses: LibreCodeCoop/release-tool/actions/artifact-validate@710c4c83fba47bf01713f46e9c4cb4cf63debfba
+        uses: LibreCodeCoop/release-tool/actions/artifact-validate@40e17457fe28003e5893bf55e3c2102c965ddb8c
         with:
           artifact: ${{ env.APP_NAME }}/build/artifacts/${{ env.APP_NAME }}.tar.gz
           app-name: ${{ env.APP_NAME }}
@@ -241,7 +241,7 @@ jobs:
 
       - name: Build nightly change list
         id: release-note-changes
-        uses: LibreCodeCoop/release-tool/actions/release-notes@710c4c83fba47bf01713f46e9c4cb4cf63debfba
+        uses: LibreCodeCoop/release-tool/actions/release-notes@40e17457fe28003e5893bf55e3c2102c965ddb8c
         with:
           repository: ${{ github.repository }}
           branch: ${{ steps.nightly.outputs.branch }}
diff --git a/workflow-templates/prepare-release.yml b/workflow-templates/prepare-release.yml
index 586af43..452a179 100644
--- a/workflow-templates/prepare-release.yml
+++ b/workflow-templates/prepare-release.yml
@@ -81,7 +81,7 @@ jobs:
           git fetch --quiet --unshallow --prune origin             "+refs/heads/${RELEASE_BRANCH}:refs/remotes/origin/${RELEASE_BRANCH}"             "+refs/tags/*:refs/tags/*"
 
       - name: Prepare release
-        uses: LibreCodeCoop/release-tool/actions/prepare@710c4c83fba47bf01713f46e9c4cb4cf63debfba
+        uses: LibreCodeCoop/release-tool/actions/prepare@40e17457fe28003e5893bf55e3c2102c965ddb8c
         with:
           branch: ${{ inputs.branch }}
           ref: ${{ inputs.ref }}
@@ -125,7 +125,7 @@ jobs:
           git fetch --quiet --unshallow --prune origin             "+refs/heads/${RELEASE_BRANCH}:refs/remotes/origin/${RELEASE_BRANCH}"             "+refs/tags/*:refs/tags/*"
 
       - name: Finalize merged release
-        uses: LibreCodeCoop/release-tool/actions/post-merge@710c4c83fba47bf01713f46e9c4cb4cf63debfba
+        uses: LibreCodeCoop/release-tool/actions/post-merge@40e17457fe28003e5893bf55e3c2102c965ddb8c
         with:
           pull-request-number: ${{ github.event.pull_request.number }}
           merger: ${{ github.event.pull_request.merged_by.login }}
@@ -151,7 +151,7 @@ jobs:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Verify publication
-        uses: LibreCodeCoop/release-tool/actions/publication@710c4c83fba47bf01713f46e9c4cb4cf63debfba
+        uses: LibreCodeCoop/release-tool/actions/publication@40e17457fe28003e5893bf55e3c2102c965ddb8c
         with:
           github-release-id: ${{ github.event.release.id }}
           config-path: .nextcloud-release.yml