diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d048605..143f506 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -95,22 +95,22 @@ jobs:
               exit 1
             fi
 
-            payload=$(TAG="$TAG" python3 -c '
+            payload=$(TAG="$TAG" GH_SHA="$GITHUB_SHA" python3 - <<'PYEOF'
             import json, os
-            tag = os.environ["TAG"]
             print(json.dumps({
-                "tag_name": tag,
-                "name": tag,
+                "tag_name": os.environ["TAG"],
+                "name": os.environ["TAG"],
                 "body": (
                     "Automated release.\n\n"
-                    "Built from commit " + os.environ.get("GITHUB_SHA", "unknown") + ".\n\n"
+                    "Built from commit " + os.environ.get("GH_SHA", "unknown") + ".\n\n"
                     "See the workflow run for the artifact."
                 ),
                 "draft": False,
                 "prerelease": False,
                 "generate_release_notes": True,
             }))
-            ')
+            PYEOF
+            )
 
             release_json=$(curl -fsS -X POST \
               -H "Authorization: token ${GITHUB_TOKEN}" \
@@ -144,21 +144,21 @@ jobs:
               API="${GH_API_URL%/}/api/v1"
             fi
 
-            payload=$(TAG="$TAG" python3 -c '
+            payload=$(TAG="$TAG" GH_SHA="$GITHUB_SHA" python3 - <<'PYEOF'
             import json, os
-            tag = os.environ["TAG"]
             print(json.dumps({
-                "tag_name": tag,
-                "name": tag,
+                "tag_name": os.environ["TAG"],
+                "name": os.environ["TAG"],
                 "body": (
                     "Automated release.\n\n"
-                    "Built from commit " + os.environ.get("GITHUB_SHA", "unknown") + ".\n\n"
+                    "Built from commit " + os.environ.get("GH_SHA", "unknown") + ".\n\n"
                     "See the workflow run for the artifact."
                 ),
                 "draft": False,
                 "prerelease": False,
             }))
-            ')
+            PYEOF
+            )
 
             release_json=$(curl -fsS -X POST \
               -H "Authorization: token ${GITEA_TOKEN}" \