diff --git a/tests/test_release_tool_pins.py b/tests/test_release_tool_pins.py
index db918fd..06c3b46 100644
--- a/tests/test_release_tool_pins.py
+++ b/tests/test_release_tool_pins.py
@@ -16,6 +16,12 @@
 
 
 class ReleaseToolPinsTest(unittest.TestCase):
+    def test_prepare_release_keeps_trusted_pipeline_contract(self) -> None:
+        content = (ROOT / "workflow-templates/prepare-release.yml").read_text(encoding="utf-8")
+        self.assertIn("pipeline-reference-ref: refs/remotes/origin/main", content)
+        self.assertIn("post-merge-event: pull_request_target", content)
+        self.assertIn('git fetch --quiet origin "+refs/heads/main:refs/remotes/origin/main"', content)
+
     def test_release_tool_consumers_use_same_release(self) -> None:
         for path in SURFACES:
             content = path.read_text(encoding="utf-8")
diff --git a/workflow-templates/prepare-release.yml b/workflow-templates/prepare-release.yml
index 452a179..b17dc4b 100644
--- a/workflow-templates/prepare-release.yml
+++ b/workflow-templates/prepare-release.yml
@@ -80,6 +80,12 @@ jobs:
           set -euo pipefail
           git fetch --quiet --unshallow --prune origin             "+refs/heads/${RELEASE_BRANCH}:refs/remotes/origin/${RELEASE_BRANCH}"             "+refs/tags/*:refs/tags/*"
 
+      - name: Fetch trusted release pipeline reference
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch --quiet origin "+refs/heads/main:refs/remotes/origin/main"
+
       - name: Prepare release
         uses: LibreCodeCoop/release-tool/actions/prepare@40e17457fe28003e5893bf55e3c2102c965ddb8c
         with:
@@ -93,6 +99,7 @@ jobs:
           actor: ${{ github.actor }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
           app-private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
+          pipeline-reference-ref: refs/remotes/origin/main
 
   post_merge:
     name: Finalize release and prepare draft
@@ -156,4 +163,5 @@ jobs:
           github-release-id: ${{ github.event.release.id }}
           config-path: .nextcloud-release.yml
           post-merge-workflow-path: .github/workflows/prepare-release.yml
+          post-merge-event: pull_request_target
           github-token: ${{ secrets.GITHUB_TOKEN }}