diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 259f2dc91..1902768a1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,6 +21,11 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          # Build the code at the tag being released, not whatever branch the
+          # dispatch ran from. On a tag push this is the tag ref already; on
+          # workflow_dispatch it pins the checkout to the requested tag so the
+          # artifacts cannot be built from one ref and published under another.
+          ref: ${{ github.event.inputs.tag || github.ref }}
 
       - name: Set up Go
         uses: actions/setup-go@v5
diff --git a/Makefile b/Makefile
index 2573608e8..45017ff8d 100644
--- a/Makefile
+++ b/Makefile
@@ -25,8 +25,12 @@ help: ## print this help
 getdeps: ## fetch necessary dependencies
 	@mkdir -p ${GOPATH}/bin
 	@if [ ! -x "$(GOLANGCI)" ]; then \
+		set -e; \
 		echo "Installing golangci-lint $(GOLANGCI_VERSION)"; \
-		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/$(GOLANGCI_VERSION)/install.sh | sh -s -- -b $(GOLANGCI_DIR) $(GOLANGCI_VERSION); \
+		script=$$(mktemp); \
+		trap 'rm -f "$$script"' EXIT; \
+		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/$(GOLANGCI_VERSION)/install.sh -o "$$script"; \
+		sh "$$script" -b $(GOLANGCI_DIR) $(GOLANGCI_VERSION); \
 	fi
 
 crosscompile: ## cross compile minio
@@ -53,7 +57,7 @@ check-gen: ## check for updated autogenerated files
 lint: getdeps ## runs golangci-lint suite of linters
 	@echo "Running $@ check"
 	@$(GOLANGCI) run --build-tags kqueue --timeout=10m --config ./.golangci.yml
-	@command typos && typos ./ || echo "typos binary is not found.. skipping.."
+	@if command -v typos >/dev/null 2>&1; then typos ./; else echo "typos binary is not found.. skipping.."; fi
 
 lint-fix: getdeps ## runs golangci-lint suite of linters with automatic fixes
 	@echo "Running $@ check"