diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index bed17982..8ad568dd 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -3,12 +3,6 @@ name: Upload Python Package
 on:
   release:
     types: [ published ]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version to use for this test run (no commit/push/tag/publish will actually happen)'
-        required: false
-        default: '0.0.0-test'
 
 jobs:
   bump-version:
@@ -39,11 +33,9 @@ jobs:
 
       - name: Bump version
         env:
-          INITIAL_TAG: ${{ github.event.release.tag_name || inputs.version }}
-          # TEMPORARY DRY-RUN OVERRIDE - forces test mode even for real releases.
-          # Original: ${{ github.event_name == 'workflow_dispatch' }}
-          # Revert this commit before running a real release.
-          IS_TEST_RUN: 'true'
+          # Passed via env, never interpolated into the script: a git tag name may legally contain
+          # ; $ ` & | ( ), so inlining it in the script would let a crafted release tag run commands.
+          INITIAL_TAG: ${{ github.event.release.tag_name }}
         run: |
           tag="${INITIAL_TAG//[v]/}"
           echo "$tag"
@@ -55,20 +47,14 @@ jobs:
           git config --global user.email "github-actions@github.com"
           git config --global user.name "Github Actions"
           echo "finished configuration"
-          bump-my-version bump --config-file .bump_version.toml --current-version 0.0.0 --new-version "$tag"
+          bump-my-version bump --config-file .bump_version.toml --current-version 0.0.0 --new-version $tag
           echo "bumpversion finished"
           auto-changelog
           git add .
           git commit -m "release $tag"
-          if [ "$IS_TEST_RUN" = "true" ]; then
-            echo "Test run: skipping git push"
-          else
-            git push
-          fi
+          git push
 
       - name: Move tag
-        # TEMPORARY DRY-RUN OVERRIDE - original: github.event_name == 'release'
-        if: false
         env:
           TAG_NAME: ${{ github.event.release.tag_name }}
         run: |
@@ -103,14 +89,5 @@ jobs:
         run: python -m build
 
       - name: Publish package to PyPI
-        # TEMPORARY DRY-RUN OVERRIDE - original: github.event_name == 'release'
-        if: false
         uses: pypa/gh-action-pypi-publish@release/v1
-        # No user/password needed - OIDC handles authentication
-
-      - name: Validate package (dry run)
-        # TEMPORARY DRY-RUN OVERRIDE - original: github.event_name == 'workflow_dispatch'
-        if: true
-        run: |
-          pip install twine
-          twine check dist/*
\ No newline at end of file
+        # No user/password needed - OIDC handles authentication
\ No newline at end of file