diff --git a/lib/spack/spack/solver/asp.py b/lib/spack/spack/solver/asp.py
index 46d02bde053..48acaef7ba3 100644
--- a/lib/spack/spack/solver/asp.py
+++ b/lib/spack/spack/solver/asp.py
@@ -4280,7 +4280,7 @@ def _specs_with_commits(spec):
 
     # Specs with commit variants
     # - variant value satsifies commit regex
-    # - paired to a GitVersion or can create GitVersion from version that was selected
+    # - paired to a GitVersion or version that is associated with a branch/tag
     # - variant value should match GitVersion's commit value
     if has_commit_var:
         invalid_commit_msg = (
@@ -4300,6 +4300,11 @@ def _specs_with_commits(spec):
             return
 
         spec.variants["commit"] = vt.SingleValuedVariant("commit", spec.version.commit_sha)
+    else:
+        # if we are not a GitVersion then only versions with a branch or tag should be
+        # allowed to have the commit variant
+        version_dict = spec.package_class.versions.get(spec.version, {})
+        assert version_dict.get("branch") or version_dict.get("tag")
 
 
 def _develop_specs_from_env(spec, env):
diff --git a/lib/spack/spack/test/concretization/core.py b/lib/spack/spack/test/concretization/core.py
index 42d0725588e..60f82fcbdcb 100644
--- a/lib/spack/spack/test/concretization/core.py
+++ b/lib/spack/spack/test/concretization/core.py
@@ -3311,9 +3311,11 @@ def _ensure_cache_hits(self, problem: str):
 @pytest.mark.parametrize(
     "spec_str, should_pass, error_type",
     [
-        (f"git-ref-package@main commit={'a' *40}", True, None),
-        (f"git-ref-package@main commit={'a' *39}", False, AssertionError),
-        # TODO only versions with git refs should allow the commit variant
+        (f"git-ref-package@main commit={'a' * 40}", True, None),
+        (f"git-ref-package@main commit={'a' * 39}", False, AssertionError),
+        (f"git-ref-package@2.1.6 commit={'a' * 40}", False, AssertionError),
+        (f"git-ref-package@git.2.1.6=2.1.6 commit={'a' * 40}", True, None),
+        (f"git-ref-package@2.1.6 commit={'a' * 40}", False, AssertionError),
     ],
 )
 def test_spec_containing_commit_variant(spec_str, should_pass, error_type):
@@ -3326,7 +3328,7 @@ def test_spec_containing_commit_variant(spec_str, should_pass, error_type):
 
 
 @pytest.mark.usefixtures("mutable_config", "mock_packages", "do_not_check_runtimes_on_reuse")
-@pytest.mark.parametrize("version_str", [f"git.{'a' *40}=main", "git.2.1.5=main"])
+@pytest.mark.parametrize("version_str", [f"git.{'a' * 40}=main", "git.2.1.5=main"])
 def test_relationship_git_versions_and_commit_variant(version_str):
     spec = spack.spec.Spec(f"git-ref-package@{version_str}").concretized()
     if spec.version.commit_sha: