diff --git a/crates/protovalidate-rs/third_party/protovalidate-cc b/crates/protovalidate-rs/third_party/protovalidate-cc
index 5f8219d2..dbc6dfe6 160000
--- a/crates/protovalidate-rs/third_party/protovalidate-cc
+++ b/crates/protovalidate-rs/third_party/protovalidate-cc
@@ -1 +1 @@
-Subproject commit 5f8219d280b4ad65abd0adcd17b50d0ed30d2406
+Subproject commit dbc6dfe6855491a62da4fa2ced46ff2163f13d11
diff --git a/scripts/extract/versions.json b/scripts/extract/versions.json
index c8eebc38..65837d5a 100644
--- a/scripts/extract/versions.json
+++ b/scripts/extract/versions.json
@@ -5,8 +5,8 @@
   "protovalidate_cc": {
     "comment": ["1.2.0 not released yet so target unreleased commit"],
     "archive": "https://github.com/bufbuild/protovalidate-cc/archive/{ref}.tar.gz",
-    "ref": "5f8219d280b4ad65abd0adcd17b50d0ed30d2406",
-    "sha256": "e7b03936881be348ffeeba10f12d6507828f536f53750cbd6de7f1bedacc0e6b"
+    "ref": "dbc6dfe6855491a62da4fa2ced46ff2163f13d11",
+    "sha256": "4ed5feee2e64c7484c9bb49e37808ab381adec63d752c152ea9573e74f497e97"
   },
   "module_overrides": {
     "_comment": ["Use newer cel-cpp for Windows compatibility."],
diff --git a/scripts/extract_native_sources.py b/scripts/extract_native_sources.py
index dacd0499..c7e7ca65 100755
--- a/scripts/extract_native_sources.py
+++ b/scripts/extract_native_sources.py
@@ -127,6 +127,9 @@ class Repo(typing.NamedTuple):
 
 VENDOR_HEADER_SUFFIXES = (".h", ".hpp", ".inc", ".def")
 
+# A ref pinned by commit rather than by tag.
+COMMIT_SHA = re.compile(r"[0-9a-f]{40}")
+
 # The probe package this script injects into the extraction workspace.
 PROBE_PACKAGE = "pv_extract"
 
@@ -157,6 +160,12 @@ def run(cmd: list[str], cwd: Path, *, capture: bool = False) -> str:
     return ""
 
 
+def try_run(cmd: list[str], cwd: Path) -> bool:
+    """Runs a command that is allowed to fail, reporting whether it worked."""
+    print(f"  $ {' '.join(cmd[:6])}{' ...' if len(cmd) > 6 else ''}", flush=True)
+    return subprocess.run(cmd, cwd=cwd, check=False).returncode == 0
+
+
 class Aquery:
     """Indexed view over one `bazel aquery --output=jsonproto` result."""
 
@@ -767,22 +776,22 @@ def resolve_in_submodule(path: Path, ref: str) -> str:
         found = git(path, "rev-parse", "--verify", "--quiet", candidate, check=False)
         if found:
             return found
-    # Not present locally yet so fetch first.
-    for fetch_args in (["origin", "tag", ref], ["origin", ref]):
-        run(
+    # Not present locally yet, so fetch first.
+    fetches = [["origin", ref]]
+    if not COMMIT_SHA.fullmatch(ref):
+        fetches.insert(0, ["origin", "tag", ref])
+    for fetch_args in fetches:
+        if not try_run(
             ["git", "-C", str(path), "fetch", "--depth", "1", *fetch_args],
             cwd=REPO_ROOT,
-        )
-        found = git(
-            path, "rev-parse", "--verify", "--quiet", f"{ref}^{{commit}}", check=False
-        )
-        if found:
-            return found
-        found = git(
-            path, "rev-parse", "--verify", "--quiet", "FETCH_HEAD^{commit}", check=False
-        )
-        if found:
-            return found
+        ):
+            continue
+        for candidate in (f"{ref}^{{commit}}", "FETCH_HEAD^{commit}"):
+            found = git(
+                path, "rev-parse", "--verify", "--quiet", candidate, check=False
+            )
+            if found:
+                return found
     message = f"could not resolve {ref} in {path}"
     raise SystemExit(message)