diff --git a/.github/bump-tracking.json b/.github/bump-tracking.json
new file mode 100644
index 00000000..4624fa9a
--- /dev/null
+++ b/.github/bump-tracking.json
@@ -0,0 +1,6 @@
+{
+  "releases-only": [
+    "crowdstrike-falcon-foundry",
+    "crowdstrike-falcon-fusion"
+  ]
+}
diff --git a/.github/workflows/bump-plugin-shas.yml b/.github/workflows/bump-plugin-shas.yml
index 371a4f17..37e96e0e 100644
--- a/.github/workflows/bump-plugin-shas.yml
+++ b/.github/workflows/bump-plugin-shas.yml
@@ -57,13 +57,18 @@ jobs:
 
       # createCommitOnBranch-based bump so commits are signed by GitHub and
       # satisfy the org-level required_signatures ruleset on main.
-      - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@426e469f322952061102b286b378c0c9733a0934
+      - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@9247660a88cf3f49456a2f6464d66fe4ea4f4a77
         id: bump
         with:
           marketplace-path: .claude-plugin/marketplace.json
           max-bumps: ${{ inputs.max_bumps || '30' }}
           only: ${{ inputs.plugin }}
           pr-mode: per-entry
+          # Entries listed in .github/bump-tracking.json {"releases-only": [...]}
+          # bump to the latest published release tag's commit instead of HEAD
+          # (no release / not-ahead / lookup failure -> pin held; see the action
+          # README). All other entries HEAD-track exactly as before.
+          tracking-config: .github/bump-tracking.json
           claude-cli-version: latest
 
       # Per-entry fan-out: dispatch the three required checks against each bump