diff --git a/.github/workflows/snowflake_regression_tests.yml b/.github/workflows/snowflake_regression_tests.yml
index 3dcc9fe..959a4af 100644
--- a/.github/workflows/snowflake_regression_tests.yml
+++ b/.github/workflows/snowflake_regression_tests.yml
@@ -8,13 +8,18 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+# The only thing this workflow needs the token for is actions/checkout and
+# the public clones below. Nothing here writes to the repo.
+permissions:
+  contents: read
+
 jobs:
   run-scripts:
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-22.04]
-        pgver: [15, 16, 17, 18]
+        pgver: [15, 16, 17, 18, 19]
 
     runs-on: ${{ matrix.os }}
 
@@ -37,7 +42,7 @@ jobs:
 
     - name: Run Docker Container with Unique Port
       run: |
-        PGPORT=$((5400 + ${{ matrix.pgver }}))  # Assign unique ports (5415, 5416, 5417)
+        PGPORT=$((5400 + ${{ matrix.pgver }}))  # Assign unique ports (5415 .. 5419)
         CONTAINER_NAME=snowflake-${{ matrix.pgver }}  # Unique container name
     
         echo "Starting PostgreSQL container: $CONTAINER_NAME on port $PGPORT"
@@ -112,15 +117,36 @@ jobs:
         "
 
     - name: Checkout the latest PostgreSQL tag that matches matrix.pgver
+      env:
+        MATRIX_PGVER: ${{ matrix.pgver }}
       run: |
-        docker exec -u postgres snowflake-${{ matrix.pgver }} bash -c "
-          cd /home/postgres/postgres-source && \
-          git fetch --tags && \
-          MATRIX_PGVER=${{ matrix.pgver }} && \
-          LATEST_TAG=\$(git tag -l \"REL_\${MATRIX_PGVER}*\" | grep -Eo 'REL_[0-9]+_[0-9]+(_[0-9]+)?' | sort -V | tail -n 1) && \
-          git checkout \$LATEST_TAG && \
-          echo \"Checked out tag: \$LATEST_TAG\"
-        "
+        docker exec -u postgres -e MATRIX_PGVER="$MATRIX_PGVER" \
+          snowflake-"$MATRIX_PGVER" bash -c '
+          set -e
+          cd /home/postgres/postgres-source
+          git fetch --tags
+
+          # Released majors: pick the newest stable minor, e.g. REL_18_1.
+          LATEST_TAG=$(git tag -l "REL_${MATRIX_PGVER}_*" \
+            | grep -E "^REL_${MATRIX_PGVER}_[0-9]+$" | sort -V | tail -n 1)
+
+          # Pre-GA majors (PG 19 today) have only REL_<major>_BETAn / _RCn
+          # tags, which the stable pattern above deliberately skips. sort -V
+          # orders BETA1 < BETA2 < BETA3 < RC1, so the newest pre-release wins.
+          if [ -z "$LATEST_TAG" ]; then
+            LATEST_TAG=$(git tag -l "REL_${MATRIX_PGVER}_*" \
+              | grep -E "^REL_${MATRIX_PGVER}_(BETA|RC)[0-9]+$" | sort -V | tail -n 1)
+            echo "No stable tag for PG ${MATRIX_PGVER}; using a pre-release tag."
+          fi
+
+          if [ -z "$LATEST_TAG" ]; then
+            echo "Error: no REL_${MATRIX_PGVER}_* tag found" >&2
+            exit 1
+          fi
+
+          git checkout "$LATEST_TAG"
+          echo "Checked out tag: $LATEST_TAG"
+        '
 
     - name: Configure, build, and install PostgreSQL
       run: |
@@ -193,7 +219,7 @@ jobs:
           # Clone Snowflake extension if it doesn't exist
           if [ ! -d \"snowflake\" ]; then \
             echo 'Cloning Snowflake extension...' && \
-            git clone https://x-access-token:${GITHUB_TOKEN}@github.com/pgEdge/snowflake.git snowflake; \
+            git clone https://github.com/pgEdge/snowflake.git snowflake; \
           fi && \
 
           # Move into the Snowflake extension directory
@@ -203,8 +229,6 @@ jobs:
           echo 'Building Snowflake extension...' && \
           USE_PGXS=1 make
         "
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Make Install Snowflake as Root
       run: |