diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fa4f7644c..259f2dc91 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,15 +38,24 @@ jobs:
           fi
 
       - name: Compute release variables
+        env:
+          # Passed through the environment, never interpolated into the script
+          # body: a dispatch input reaches bash as data, so it cannot inject
+          # commands the way a `${{ ... }}` splice into the source would.
+          INPUT_TAG: ${{ github.event.inputs.tag }}
         run: |
           set -euo pipefail
-          TAG="${{ github.event.inputs.tag || github.ref_name }}"
-          VERSION_HYPHEN="${TAG#RELEASE.}"
-          PKG_VERSION="$(echo "${VERSION_HYPHEN}" | sed -E 's/^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/\1\2\3\4\5\6.0.0/')"
-          if [ "${PKG_VERSION}" = "${VERSION_HYPHEN}" ]; then
-            echo "Invalid release tag format: ${TAG}"
+          TAG="${INPUT_TAG:-${GITHUB_REF_NAME}}"
+          # Whitelist the exact tag shape before the value is used anywhere. bash
+          # =~ anchors ^...$ to the whole string (not per line, as sed would), so
+          # a tag carrying a newline cannot pass and then smuggle extra lines into
+          # $GITHUB_ENV below.
+          if [[ ! "${TAG}" =~ ^RELEASE\.[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}-[0-9]{2}-[0-9]{2}Z$ ]]; then
+            echo "Invalid release tag format: ${TAG}" >&2
             exit 1
           fi
+          VERSION_HYPHEN="${TAG#RELEASE.}"
+          PKG_VERSION="$(echo "${VERSION_HYPHEN}" | sed -E 's/^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/\1\2\3\4\5\6.0.0/')"
           VERSION_COLON="$(echo "${VERSION_HYPHEN}" | sed -E 's/T([0-9]{2})-([0-9]{2})-([0-9]{2})Z$/T\1:\2:\3Z/')"
           LDFLAGS="$(MINIO_RELEASE=RELEASE go run buildscripts/gen-ldflags.go "${VERSION_COLON}")"