You can. The huggingface_hub revision parameter accepts a tag, a branch, a pull request ref such as refs/pr/3, or a full commit hash. For production use only the full commit hash, because the other forms can point at different content later or at content the owner has not reviewed.
The four things revision accepts
The download guide gives these examples for hf_hub_download: a tag like v1.0, a branch like test-branch, a pull request reference like refs/pr/3, and a specific commit hash. It also notes that a commit hash must be the full length hash, not a 7 character short form.
| Revision type | Can it move? | Who controls it | Fit for production |
|---|---|---|---|
| Branch | Yes, on every push | Repo owner | No |
| Tag | Tags are labels in git and can be re-pointed by someone with write access | Repo owner | Weak |
| Pull request ref | Contributors can add commits to it | Contributor and owner | No |
| Full commit hash | No, it names one commit | Fixed once published | Yes |
The tag row reflects how git tags work in general, not a Hub specific promise. Check the Hub's behavior for your case before you depend on tags staying fixed.
Why the pull request ref is special
A pull request on a model repo is a proposed change that can come from a contributor, not only from the owner. The Hub's webhook documentation notes that new pull requests create a new reference and commit. Loading from refs/pr/3 means loading content that the owner may not have approved or even read.
Teams sometimes do this on purpose to test a fix before it is merged. That is fine in a scratch notebook. It is a poor fit for a pipeline, because the ref can receive new commits after you tested.
What to do instead
- In code, pass the full 40 character commit hash as the revision.
- Store the hash in a config file under version control, so changes appear in review.
- If you need a fix from a pull request, wait for the owner to merge it, or copy the reviewed files into your own storage and pin your copy.
- Check that the downloaded snapshot folder in the cache is named for that exact hash. The cache documentation says each known revision gets its own snapshot folder.
- Add a test that fails if the revision value is not a 40 character hex string.
A test you can write today
A simple check in your repository can scan code and config for model download calls and flag any that omit a revision or use a short value. This is cheap, catches drift early, and does not depend on any one library.
Quick check
Is a seven character commit hash accepted as a revision?
The download guide says it must be the full length hash, not a 7 character one.
Is a tag as safe as a hash?
No. In git a tag is a label that can be moved by someone with write access. A full hash names one commit.
Safeguard's policies and gates can hold a pull request that changes dependency pins, and its dependency scanning covers the packages around the model. Try the free scan.
Sources
- huggingface_hub documentation, Download files
- Hugging Face Hub documentation, Webhooks
- huggingface_hub documentation, Manage cache
Last reviewed: 19 October 2026.
