diff --git a/release.sh b/release.sh
index f7f54aa0..342b727c 100755
--- a/release.sh
+++ b/release.sh
@@ -594,8 +594,11 @@ function release::create_tags() {
   local major_tag
   major_tag=$(release::major_tag "$new_version")
 
-  git tag -a -m "$new_version" "$new_version"
-  git tag -f -a -m "$major_tag" "$major_tag" "${new_version}^{}"
+  # Silence git's own stdout ("Updated tag 'v0' (was ...)" when -f replaces an
+  # existing tag) so it cannot leak into this function's stdout, which the
+  # caller captures as the major tag name. Errors still surface on stderr.
+  git tag -a -m "$new_version" "$new_version" >/dev/null
+  git tag -f -a -m "$major_tag" "$major_tag" "${new_version}^{}" >/dev/null
 
   echo "$major_tag"
 }
diff --git a/tests/unit/release_utilities_test.sh b/tests/unit/release_utilities_test.sh
index 6c83c8af..1f391c32 100644
--- a/tests/unit/release_utilities_test.sh
+++ b/tests/unit/release_utilities_test.sh
@@ -405,3 +405,21 @@ function test_create_tags_returns_major_tag_name() {
   cd "$origin" || return 1
   rm -rf "$repo"
 }
+
+# Regression: when the major tag already exists, `git tag -f` prints
+# "Updated tag 'v0' (was ...)" to stdout. That must not leak into the
+# returned major tag name (it previously did, producing an invalid push
+# refspec during a real release).
+function test_create_tags_returns_clean_name_when_major_tag_already_exists() {
+  local repo origin result
+  repo="$(_create_tags_setup_repo)"
+  origin="$(pwd)"
+
+  cd "$repo" || return 1
+  git tag v0 # pre-existing major tag -> -f takes the update path
+  result="$(release::create_tags '0.40.0')"
+  assert_same "v0" "$result" # exactly "v0", no "Updated tag ..." noise
+
+  cd "$origin" || return 1
+  rm -rf "$repo"
+}