diff --git a/pkg/cli/compile_post_processing.go b/pkg/cli/compile_post_processing.go
index 856a527bab2..46db94c0e81 100644
--- a/pkg/cli/compile_post_processing.go
+++ b/pkg/cli/compile_post_processing.go
@@ -69,7 +69,7 @@ func generateMaintenanceWorkflowWrapper(
 ) error {
 	compilePostProcessingLog.Print("Generating maintenance workflow")
 
-	if err := workflow.GenerateMaintenanceWorkflow(workflowDataList, workflowsDir, compiler.GetVersion(), compiler.GetActionMode(), verbose); err != nil {
+	if err := workflow.GenerateMaintenanceWorkflow(workflowDataList, workflowsDir, compiler.GetVersion(), compiler.GetActionMode(), compiler.GetActionTag(), verbose); err != nil {
 		if strict {
 			return fmt.Errorf("failed to generate maintenance workflow: %w", err)
 		}
diff --git a/pkg/cli/init.go b/pkg/cli/init.go
index 9e4c8a619f7..6cc3ded6006 100644
--- a/pkg/cli/init.go
+++ b/pkg/cli/init.go
@@ -325,7 +325,7 @@ func ensureMaintenanceWorkflow(verbose bool) error {
 	// Always call GenerateMaintenanceWorkflow even with empty list
 	// This allows it to delete existing maintenance workflow if no workflows have expires
 	initLog.Printf("Generating maintenance workflow for %d workflows", len(workflowDataList))
-	if err := workflow.GenerateMaintenanceWorkflow(workflowDataList, workflowsDir, GetVersion(), compiler.GetActionMode(), verbose); err != nil {
+	if err := workflow.GenerateMaintenanceWorkflow(workflowDataList, workflowsDir, GetVersion(), compiler.GetActionMode(), compiler.GetActionTag(), verbose); err != nil {
 		return fmt.Errorf("failed to generate maintenance workflow: %w", err)
 	}
 
diff --git a/pkg/workflow/maintenance_workflow.go b/pkg/workflow/maintenance_workflow.go
index f854dbdae02..963ab9e1ccf 100644
--- a/pkg/workflow/maintenance_workflow.go
+++ b/pkg/workflow/maintenance_workflow.go
@@ -37,7 +37,7 @@ func generateMaintenanceCron(minExpiresDays int) (string, string) {
 
 // GenerateMaintenanceWorkflow generates the agentics-maintenance.yml workflow
 // if any workflows use the expires field for discussions or issues
-func GenerateMaintenanceWorkflow(workflowDataList []*WorkflowData, workflowDir string, version string, actionMode ActionMode, verbose bool) error {
+func GenerateMaintenanceWorkflow(workflowDataList []*WorkflowData, workflowDir string, version string, actionMode ActionMode, actionTag string, verbose bool) error {
 	maintenanceLog.Print("Checking if maintenance workflow is needed")
 
 	// Check if any workflow uses expires field for discussions, issues, or pull requests
@@ -150,7 +150,7 @@ jobs:
 	// Get the setup action reference (local or remote based on mode)
 	// Pass nil for data since maintenance workflow doesn't have WorkflowData
 	// In release mode without data, it will return tag-based reference
-	setupActionRef := ResolveSetupActionReference(actionMode, version, "", nil)
+	setupActionRef := ResolveSetupActionReference(actionMode, version, actionTag, nil)
 
 	// Add checkout step only in dev mode (for local action paths)
 	if actionMode == ActionModeDev {
diff --git a/pkg/workflow/maintenance_workflow_test.go b/pkg/workflow/maintenance_workflow_test.go
index 50233500b1d..d72b3975582 100644
--- a/pkg/workflow/maintenance_workflow_test.go
+++ b/pkg/workflow/maintenance_workflow_test.go
@@ -5,6 +5,7 @@ package workflow
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -148,7 +149,7 @@ func TestGenerateMaintenanceWorkflow_WithExpires(t *testing.T) {
 			tmpDir := t.TempDir()
 
 			// Call GenerateMaintenanceWorkflow
-			err := GenerateMaintenanceWorkflow(tt.workflowDataList, tmpDir, "v1.0.0", ActionModeDev, false)
+			err := GenerateMaintenanceWorkflow(tt.workflowDataList, tmpDir, "v1.0.0", ActionModeDev, "", false)
 
 			// Check error expectation
 			if tt.expectError && err == nil {
@@ -237,7 +238,7 @@ func TestGenerateMaintenanceWorkflow_DeletesExistingFile(t *testing.T) {
 			}
 
 			// Call GenerateMaintenanceWorkflow
-			err := GenerateMaintenanceWorkflow(tt.workflowDataList, tmpDir, "v1.0.0", ActionModeDev, false)
+			err := GenerateMaintenanceWorkflow(tt.workflowDataList, tmpDir, "v1.0.0", ActionModeDev, "", false)
 			if err != nil {
 				t.Errorf("Unexpected error: %v", err)
 			}
@@ -255,3 +256,49 @@ func TestGenerateMaintenanceWorkflow_DeletesExistingFile(t *testing.T) {
 		})
 	}
 }
+
+func TestGenerateMaintenanceWorkflow_ActionTag(t *testing.T) {
+	workflowDataList := []*WorkflowData{
+		{
+			Name: "test-workflow",
+			SafeOutputs: &SafeOutputsConfig{
+				CreateIssues: &CreateIssuesConfig{
+					Expires: 48,
+				},
+			},
+		},
+	}
+
+	t.Run("release mode with action-tag uses remote ref", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		err := GenerateMaintenanceWorkflow(workflowDataList, tmpDir, "v1.0.0", ActionModeRelease, "v0.47.4", false)
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		content, err := os.ReadFile(filepath.Join(tmpDir, "agentics-maintenance.yml"))
+		if err != nil {
+			t.Fatalf("Expected maintenance workflow to be generated: %v", err)
+		}
+		if !strings.Contains(string(content), "github/gh-aw/actions/setup@v0.47.4") {
+			t.Errorf("Expected remote ref with action-tag v0.47.4, got:\n%s", string(content))
+		}
+		if strings.Contains(string(content), "uses: ./actions/setup") {
+			t.Errorf("Expected no local path in release mode with action-tag, got:\n%s", string(content))
+		}
+	})
+
+	t.Run("dev mode ignores action-tag and uses local path", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		err := GenerateMaintenanceWorkflow(workflowDataList, tmpDir, "v1.0.0", ActionModeDev, "v0.47.4", false)
+		if err != nil {
+			t.Fatalf("Unexpected error: %v", err)
+		}
+		content, err := os.ReadFile(filepath.Join(tmpDir, "agentics-maintenance.yml"))
+		if err != nil {
+			t.Fatalf("Expected maintenance workflow to be generated: %v", err)
+		}
+		if !strings.Contains(string(content), "uses: ./actions/setup") {
+			t.Errorf("Expected local path in dev mode, got:\n%s", string(content))
+		}
+	})
+}