diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5062e64..efcbdc5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -51,3 +51,25 @@ jobs:
             https://getpatchrail.com/fix*) echo "OK" ;;
             *) echo "unexpected guide-url"; exit 1 ;;
           esac
+
+  # Everyone uses `patchrail/ci-triage-action@v1`, but the jobs above test the
+  # commit, not the tag. Without this the two drift apart in silence: a merged
+  # fix stays invisible to every user while CI keeps reporting green. Move the
+  # floating tag to each main commit that passed both jobs, so `@v1` is always
+  # the newest tested code.
+  sync-v1:
+    needs: [fix-guide-slugs, smoke]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Fast-forward the v1 tag to the tested commit
+        shell: bash
+        run: |
+          set -euo pipefail
+          git tag -f v1 "${GITHUB_SHA}"
+          git push --force origin refs/tags/v1
+          echo "v1 -> ${GITHUB_SHA}"
diff --git a/README.md b/README.md
index 2fd11fa..c22eeb9 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,17 @@ step guarded by `if: failure()`. On a red run you get an annotation like
 `python-test-failure (confidence 0.89) — guide: getpatchrail.com/fix/...` plus a
 job summary block.
 
+### Which ref to pin
+
+`@v1` is a moving tag: it points at the latest commit on `main` that passed the
+test suite, and it will keep moving within the v1 line (no breaking changes to
+inputs or outputs). If you would rather review every change yourself, pin the
+full commit SHA instead:
+
+```yaml
+uses: patchrail/ci-triage-action@<commit-sha>
+```
+
 ## Inputs
 
 | Input | Default | Description |