diff --git a/packages/app/server/routes/multipart/create.post.ts b/packages/app/server/routes/multipart/create.post.ts
index 78cba966..45dd1bb0 100644
--- a/packages/app/server/routes/multipart/create.post.ts
+++ b/packages/app/server/routes/multipart/create.post.ts
@@ -1,8 +1,12 @@
-import { isWhitelisted } from "@pkg-pr-new/utils";
+import { isValidGitHash, isWhitelisted } from "@pkg-pr-new/utils";
 import { joinKeys } from "unstorage";
 
 export default eventHandler(async (event) => {
-  const { "sb-key": workflowKey, "sb-name": packageName } = getHeaders(event);
+  const {
+    "sb-key": workflowKey,
+    "sb-name": packageName,
+    "sb-sha": shaOverride,
+  } = getHeaders(event);
 
   if (!workflowKey) {
     throw createError({
@@ -35,6 +39,16 @@ export default eventHandler(async (event) => {
     });
   }
 
+  if (shaOverride) {
+    if (!isValidGitHash(shaOverride)) {
+      throw createError({
+        statusCode: 400,
+        message: "Invalid sb-sha: must be a valid hexadecimal SHA",
+      });
+    }
+    workflowData.sha = shaOverride;
+  }
+
   const binding = useBinding(event);
 
   const base = `${workflowData.owner}:${workflowData.repo}:${workflowData.sha}`;
diff --git a/packages/app/server/routes/publish.post.ts b/packages/app/server/routes/publish.post.ts
index 47fc6299..eed64a98 100644
--- a/packages/app/server/routes/publish.post.ts
+++ b/packages/app/server/routes/publish.post.ts
@@ -63,7 +63,7 @@ export default eventHandler(async (event) => {
       if (!isValidGitHash(shaOverride)) {
         throw createError({
           statusCode: 400,
-          message: "Invalid sb-sha: must be a 40-character hex SHA",
+          message: "Invalid sb-sha: must be a valid hexadecimal SHA",
         });
       }
       workflowData.sha = shaOverride;
diff --git a/packages/cli/index.ts b/packages/cli/index.ts
index 885f19c7..d4d54b79 100644
--- a/packages/cli/index.ts
+++ b/packages/cli/index.ts
@@ -517,6 +517,7 @@ const main = defineCommand({
                   headers: {
                     "sb-key": key,
                     "sb-name": name.slice("package:".length),
+                    "sb-sha": sha,
                   },
                 });
                 if (!createMultipartRes.ok) {