diff --git a/.github/workflows/windows-build.yml b/.github/workflows/windows-build.yml
index b5c9aaa..c35920e 100644
--- a/.github/workflows/windows-build.yml
+++ b/.github/workflows/windows-build.yml
@@ -40,7 +40,7 @@ jobs:
 
       - name: Test Desktop security (live release)
         env:
-          SMM_TEST_RELEASE_TAG: v0.1.0-alpha.20
+          SMM_TEST_RELEASE_TAG: ${{ vars.SMM_TEST_RELEASE_TAG || 'v0.1.0-alpha.20' }}
         run: dotnet test tests/ServerMonitorManager.Desktop.Security.Tests/ServerMonitorManager.Desktop.Security.Tests.csproj --configuration Release -p:RestoreLockedMode=true --filter Category=LiveRelease
 
       - name: Build test-signed MSIX installer
diff --git a/tests/bootstrap/test-release-version-consistency.sh b/tests/bootstrap/test-release-version-consistency.sh
index ac3211c..8db46d5 100644
--- a/tests/bootstrap/test-release-version-consistency.sh
+++ b/tests/bootstrap/test-release-version-consistency.sh
@@ -19,7 +19,11 @@ grep -Fq "SMM_TAG         Release tag (default: $default_tag)" "$setup" || {
     exit 1
 }
 
-windows_tag="$(sed -n 's/^[[:space:]]*SMM_TEST_RELEASE_TAG:[[:space:]]*\([^[:space:]]*\)$/\1/p' "$windows_workflow")"
+windows_tag="$(
+    grep -E '^[[:space:]]*SMM_TEST_RELEASE_TAG:' "$windows_workflow" \
+        | grep -Eo 'v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?' \
+        | sort -u
+)"
 [[ "$windows_tag" == "$default_tag" ]] || {
     printf 'Windows live-release tag %s does not match %s\n' "$windows_tag" "$default_tag" >&2
     exit 1