diff --git a/.github/workflows/release-nirium-vault.yml b/.github/workflows/release-nirium-vault.yml
index d2b8348..7b6acca 100644
--- a/.github/workflows/release-nirium-vault.yml
+++ b/.github/workflows/release-nirium-vault.yml
@@ -11,11 +11,14 @@
 # Tag prefix is `nirium-vault-v`, not `v`: release.yml (desktop app) already
 # runs on every `v*` tag, and "vault-v1" would match it too.
 #
-# Pinned to the commit of release v25.1.0 (published 2026-03-09), reviewed on
-# 2026-11-08: it checks out the tagged commit, builds from source with
+# Pinned to commit 6b16426 of the workflow main branch (2026-10-04, stellar-cli
+# 28.1.0), reviewed on 2026-11-09. The v25.1.0 release (2026-03-09) cannot build
+# this package: soroban-sdk 29 requires stellar-cli 25.2.0 or newer, and the first
+# tag run failed on exactly that. The only changes since v25.1.0 are the CLI
+# version and actions/checkout v4 to v6. It checks out the tagged commit, builds from source with
 # `stellar contract build --optimize`, and attests the same file it uploads.
-# The pin freezes release.yml only. The actions it calls (actions/checkout@v4,
-# stellar/stellar-cli@v25.1.0, actions/attest-build-provenance@v1) resolve their
+# The pin freezes release.yml only. The actions it calls (actions/checkout@v6,
+# stellar/stellar-cli@v28.1.0, actions/attest-build-provenance@v1) resolve their
 # own tags at run time; fork the workflow if that residual risk is unacceptable.
 name: Build and Release NiriumVault
 
@@ -30,7 +33,7 @@ permissions:            # inherited by the called workflow, which cannot elevate
 
 jobs:
   release:
-    uses: stellar-expert/soroban-build-workflow/.github/workflows/release.yml@e43b241f114bcf02151c30d61088506c6ad3ae0b  # v25.1.0
+    uses: stellar-expert/soroban-build-workflow/.github/workflows/release.yml@6b16426dd3a61715ddddf83a2df322a6371fe071  # main, stellar-cli 28.1.0
     with:
       release_name: ${{ github.ref_name }}
       package: nirium-contracts