diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d060a84..32c38a5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -75,14 +75,14 @@ jobs:
       # from the build info the linker embeds. Written after SHA256SUMS, so beside it in the
       # release but outside it: that lists what bootstrap installs. Straight into dist/,
       # because the action does not create a missing output directory.
-      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+      - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           file: dist/felis-linux-amd64
           format: cyclonedx-json
           output-file: dist/felis-linux-amd64.cdx.json
           upload-artifact: false
           upload-release-assets: false
-      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+      - uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           file: dist/felis-linux-arm64
           format: cyclonedx-json