diff --git a/.github/workflows/lint-test-build.yml b/.github/workflows/lint-test-build.yml
index c239647..3c57539 100644
--- a/.github/workflows/lint-test-build.yml
+++ b/.github/workflows/lint-test-build.yml
@@ -60,14 +60,13 @@ jobs:
   publish:
     if: github.event_name != 'pull_request'
     needs: [lint-test]
-    uses: libops/.github/.github/workflows/build-push.yaml@a86300fb8020d0f7141bb9f833d89b5dbd7aa4d7 # guarded-signed-image-publisher
+    uses: libops/.github/.github/workflows/build-push.yaml@main
     with:
       ref: ${{ github.sha }}
       expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}
       additional-gar-registry: us-docker.pkg.dev/libops-images/public
       scan: true
       sign: true
-      certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@a86300fb8020d0f7141bb9f833d89b5dbd7aa4d7
     permissions:
       contents: read
       packages: write
diff --git a/ci/workflow_contract_test.go b/ci/workflow_contract_test.go
index 98a0a88..c27d42a 100644
--- a/ci/workflow_contract_test.go
+++ b/ci/workflow_contract_test.go
@@ -9,8 +9,6 @@ import (
 	"testing"
 )
 
-const sharedPublisherSHA = "a86300fb8020d0f7141bb9f833d89b5dbd7aa4d7"
-
 func repositoryRoot(t *testing.T) string {
 	t.Helper()
 	_, current, _, ok := runtime.Caller(0)
@@ -32,12 +30,11 @@ func readRepositoryFile(t *testing.T, path ...string) string {
 func TestImagePublicationUsesGuardedSharedContract(t *testing.T) {
 	workflow := readRepositoryFile(t, ".github", "workflows", "lint-test-build.yml")
 	for _, required := range []string{
-		"libops/.github/.github/workflows/build-push.yaml@" + sharedPublisherSHA,
+		"libops/.github/.github/workflows/build-push.yaml@main",
 		"additional-gar-registry: us-docker.pkg.dev/libops-images/public",
 		"expected-main-sha:",
 		"scan: true",
 		"sign: true",
-		"certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@" + sharedPublisherSHA,
 		"GCLOUD_OIDC_POOL: ${{ secrets.GCLOUD_OIDC_POOL }}",
 		"GSA: ${{ secrets.GSA }}",
 	} {
@@ -48,6 +45,9 @@ func TestImagePublicationUsesGuardedSharedContract(t *testing.T) {
 	if strings.Contains(workflow, "secrets: inherit") {
 		t.Fatal("image workflow must map only its required registry secrets")
 	}
+	if strings.Contains(workflow, "certificate-identity:") {
+		t.Fatal("image workflow must not override the managed publisher identity")
+	}
 }
 
 func TestReleaseImageCallMapsOnlyRegistrySecrets(t *testing.T) {