diff --git a/MODULE.bazel b/MODULE.bazel
index 00e9aed..4e4e711 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -5,6 +5,19 @@ http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "ht
 # NB: update_cpp_jsonnet.sh looks for these.
 CPP_JSONNET_SHA256 = "e7d14d8ad65dc334b9a9f3bd1c542a82b3b80029860a8d78fd829b23d0e9845b"
 CPP_JSONNET_GITHASH = "5a4e8e34cc1fe841bdebb983646b9b9ae8fa8ca4"
+CPP_JSONNET_RELEASE_VERSION = ""
+
+CPP_JSONNET_STRIP_PREFIX = (
+    "jsonnet-" + (
+        CPP_JSONNET_RELEASE_VERSION if CPP_JSONNET_RELEASE_VERSION else CPP_JSONNET_GITHASH
+    )
+)
+CPP_JSONNET_URL = (
+    "https://github.com/google/jsonnet/releases/download/%s/jsonnet-%s.tar.gz" % (
+        CPP_JSONNET_RELEASE_VERSION,
+        CPP_JSONNET_RELEASE_VERSION,
+    ) if CPP_JSONNET_RELEASE_VERSION else "https://github.com/google/jsonnet/archive/%s.tar.gz" % CPP_JSONNET_GITHASH
+)
 
 # We don't use a normal bazel_dep reference for the cpp_jsonnet module,
 # because we want to pin to the specific jsonnet commit (which might not
@@ -12,8 +25,8 @@ CPP_JSONNET_GITHASH = "5a4e8e34cc1fe841bdebb983646b9b9ae8fa8ca4"
 http_archive(
     name = "cpp_jsonnet",
     sha256 = CPP_JSONNET_SHA256,
-    strip_prefix = "jsonnet-%s" % CPP_JSONNET_GITHASH,
-    urls = ["https://github.com/google/jsonnet/archive/%s.tar.gz" % CPP_JSONNET_GITHASH],
+    strip_prefix = CPP_JSONNET_STRIP_PREFIX,
+    urls = [CPP_JSONNET_URL],
 )
 
 bazel_dep(name = "gazelle", version = "0.41.0", repo_name = "bazel_gazelle")
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 63300fb..33df466 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -6,6 +6,19 @@ load(
 # NB: update_cpp_jsonnet.sh looks for these.
 CPP_JSONNET_SHA256 = "e7d14d8ad65dc334b9a9f3bd1c542a82b3b80029860a8d78fd829b23d0e9845b"
 CPP_JSONNET_GITHASH = "5a4e8e34cc1fe841bdebb983646b9b9ae8fa8ca4"
+CPP_JSONNET_RELEASE_VERSION = ""
+
+CPP_JSONNET_STRIP_PREFIX = (
+    "jsonnet-" + (
+        CPP_JSONNET_RELEASE_VERSION if CPP_JSONNET_RELEASE_VERSION else CPP_JSONNET_GITHASH
+    )
+)
+CPP_JSONNET_URL = (
+    "https://github.com/google/jsonnet/releases/download/%s/jsonnet-%s.tar.gz" % (
+        CPP_JSONNET_RELEASE_VERSION,
+        CPP_JSONNET_RELEASE_VERSION,
+    ) if CPP_JSONNET_RELEASE_VERSION else "https://github.com/google/jsonnet/archive/%s.tar.gz" % CPP_JSONNET_GITHASH
+)
 
 def jsonnet_go_repositories():
     http_archive(
@@ -28,6 +41,6 @@ def jsonnet_go_repositories():
     http_archive(
         name = "cpp_jsonnet",
         sha256 = CPP_JSONNET_SHA256,
-        strip_prefix = "jsonnet-%s" % CPP_JSONNET_GITHASH,
-        urls = ["https://github.com/google/jsonnet/archive/%s.tar.gz" % CPP_JSONNET_GITHASH],
+        strip_prefix = CPP_JSONNET_STRIP_PREFIX,
+        urls = [CPP_JSONNET_URL],
     )
diff --git a/update_cpp_jsonnet.sh b/update_cpp_jsonnet.sh
index 76c4d22..30e19d9 100755
--- a/update_cpp_jsonnet.sh
+++ b/update_cpp_jsonnet.sh
@@ -6,17 +6,34 @@ set -e
 set -x
 
 cd cpp-jsonnet
-git checkout master
-git pull
-hash=$(git rev-parse HEAD)
+git remote update --prune
+
+if [[ $# -gt 0 ]]; then
+    WANT_VERSION_NAME="$1"
+    WANT_VERSION_REF=refs/tags/"$WANT_VERSION_NAME"
+else
+    WANT_VERSION_NAME=
+    WANT_VERSION_REF=refs/remotes/origin/master
+fi
+
+hash="$(git rev-parse "$WANT_VERSION_REF")"
+git checkout "$hash"
+
+if [[ -z "$WANT_VERSION_NAME" ]]; then
+    ARCHIVE_URL="https://github.com/google/jsonnet/archive/${hash}.tar.gz"
+else
+    ARCHIVE_URL="https://github.com/google/jsonnet/releases/download/${WANT_VERSION_NAME}/jsonnet-${WANT_VERSION_NAME}.tar.gz"
+fi
+
 cd ..
 go run cmd/dumpstdlibast/dumpstdlibast.go cpp-jsonnet/stdlib/std.jsonnet > astgen/stdast.go
 
-sha256=$(curl -fL https://github.com/google/jsonnet/archive/$hash.tar.gz | shasum -a 256 | awk '{print $1}')
+sha256=$(curl -fL "${ARCHIVE_URL}" | shasum -a 256 | awk '{print $1}')
 
 sed -i.bak \
     -e "s/CPP_JSONNET_SHA256 = .*/CPP_JSONNET_SHA256 = \"$sha256\"/;" \
     -e "s/CPP_JSONNET_GITHASH = .*/CPP_JSONNET_GITHASH = \"$hash\"/;" \
+    -e "s/CPP_JSONNET_RELEASE_VERSION = .*/CPP_JSONNET_RELEASE_VERSION = \"$WANT_VERSION_NAME\"/;" \
     bazel/repositories.bzl MODULE.bazel
 
 # NB: macOS sed doesn't support -i without arg. This is the easy workaround.