diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 983c0c24e..23ee319c9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,3 +1,4 @@
+---
 name: Build and upload to PyPI
 
 concurrency:
@@ -75,19 +76,23 @@ jobs:
       include: ${{ steps.set-matrix.outputs.include }}
     steps:
       - uses: actions/checkout@v4
-      - name: Install cibuildwheel
-        run: pipx install cibuildwheel==2.16.2
+      - uses: pypa/cibuildwheel@f1859528322d7b29d4493ee241a167807661dfb4 # v2.21.2
+        id: cibw
+        with:
+          # We only use this action to install cibuildwheel with a pin that
+          # dependabot can see and update, so don't actually run cibuildwheel.
+          package-dir: --help
       - id: set-matrix
         run: |
           MATRIX=$(
             {
-              cibuildwheel --print-build-identifiers --platform linux \
-              | jq -nRc '{"only": inputs, "os": "ubuntu-latest"}' \
-              && cibuildwheel --print-build-identifiers --platform macos \
-              | jq -nRc '{"only": inputs, "os": "macos-latest"}' \
-              && cibuildwheel --print-build-identifiers --platform windows \
-              | jq -nRc '{"only": inputs, "os": "windows-2019"}'
-            } | jq -sc
+              "${{ steps.cibw.outputs.cibw-path }}" --print-build-identifiers --platform linux \
+              | jq --null-input --raw-input --compact-output '{"only": inputs, "os": "ubuntu-latest"}' \
+              && "${{ steps.cibw.outputs.cibw-path }}" --print-build-identifiers --platform macos \
+              | jq --null-input --raw-input --compact-output '{"only": inputs, "os": "macos-latest"}' \
+              && "${{ steps.cibw.outputs.cibw-path }}" --print-build-identifiers --platform windows \
+              | jq --null-input --raw-input --compact-output '{"only": inputs, "os": "windows-2019"}'
+            } | jq --slurp --compact-output
           )
           echo "include=$MATRIX" >> $GITHUB_OUTPUT
         env: