diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a06f052fb..e299c7349 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,21 +4,11 @@ permissions:
   contents: read
   id-token: write
 
-on:
-  pull_request:
-  workflow_call:
-    inputs:
-      branch:
-        description: "Branch to checkout"
-        required: false
-        default: master
-        type: string
+on: [pull_request, workflow_call]
 
 jobs:
   shared-ci:
     uses: ./.github/workflows/shared-ci.yml
-    with:
-      branch: ${{ inputs.branch || 'master' }}
   pr-ci-all-required:
     if: always()
     needs:
diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml
index 7ed7ca057..6dc102757 100644
--- a/.github/workflows/prod-release.yml
+++ b/.github/workflows/prod-release.yml
@@ -14,10 +14,6 @@ on:
         description: 'NPM distribution tag'
         required: false
         default: 'latest'
-      branch:
-        description: 'The branch to release from'
-        required: false
-        default: 'master'
 
 env:
   NODE_OPTIONS: "--max-old-space-size=4096"
@@ -35,6 +31,12 @@ jobs:
     needs: [pre-release-ci]
     environment: release
     steps:
+      - name: Require a branch
+        if: github.ref_type != 'branch'
+        run: |
+          echo "::error::Dispatch this workflow from a branch (got ${{ github.ref_type }} '${{ github.ref_name }}'). To release a specific commit, point a branch at it first."
+          exit 1
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
@@ -76,11 +78,11 @@ jobs:
 
       - name: Configure git
         env:
-          BRANCH: ${{ github.event.inputs.branch }}
+          BRANCH: ${{ github.ref_name }}
         run: |
           git config --global user.name "aws-crypto-tools-ci-bot"
           git config --global user.email "no-reply@noemail.local"
-          git checkout $BRANCH
+          git checkout "$BRANCH"
 
       - name: Version packages
         env:
@@ -96,9 +98,10 @@ jobs:
     needs: [pre-release-ci, version]
     environment: release
     steps:
+      # Include the version-bump commit the version job pushed
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.inputs.branch }}
+          ref: ${{ github.ref_name }}
 
       - uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/shared-ci.yml b/.github/workflows/shared-ci.yml
index 045c5e553..88233a595 100644
--- a/.github/workflows/shared-ci.yml
+++ b/.github/workflows/shared-ci.yml
@@ -3,11 +3,6 @@ name: Shared CI Tests
 on:
   workflow_call:
     inputs:
-      branch:
-        description: "Branch to checkout"
-        required: false
-        default: master
-        type: string
       test-published-packages:
         description: 'Test against published packages instead of checked out code'
         required: false
@@ -39,7 +34,6 @@ jobs:
         # Always need repo for test scripts and configuration, even when testing published packages
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.branch }}
           fetch-depth: 0
           submodules: true