diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 4cff5b9..b81fe00 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.4.2"
+  ".": "0.4.3"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2e38e14..ee83504 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.4.3] - 2026-06-12
+
+### Fixed
+
+- Dispatch the `release.yml` pipeline with `--ref "$tag"` so the run is attributed to the tag ref instead of `main`, restoring tag-pinned OIDC claims for npm trusted publishing and provenance ([#145](https://github.com/coder/agent-tty/pull/145) by @ThomasK33).
+
 ## [0.4.2] - 2026-06-12
 
 ### Changed
diff --git a/package.json b/package.json
index aae7932..880ad39 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-tty",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Terminal automation CLI for AI agents and humans",
   "license": "Apache-2.0",
   "keywords": [