diff --git a/.github/workflows/build_and_publish_container.yml b/.github/workflows/build_and_publish_container.yml
index e5472358..70757888 100644
--- a/.github/workflows/build_and_publish_container.yml
+++ b/.github/workflows/build_and_publish_container.yml
@@ -146,7 +146,7 @@ jobs:
       security-events: write
     steps:
       # TODO: replace with $/actions/scan when GitHub ships $/ syntax (#136)
-      - uses: TomHennen/wrangle/actions/scan@5d364e686de625ccb61a0fd5b12f9b25e1ab1d41 # main 2026-08-30
+      - uses: TomHennen/wrangle/actions/scan@b16076757b2b8b3088f5e918296f85fcbbe5b9b3 # main 2026-08-30
         if: ${{ inputs.scan-tools != '' }}
         with:
           checkout: "true"
diff --git a/.github/workflows/build_and_publish_go.yml b/.github/workflows/build_and_publish_go.yml
index 3259833d..5d3ecfce 100644
--- a/.github/workflows/build_and_publish_go.yml
+++ b/.github/workflows/build_and_publish_go.yml
@@ -183,7 +183,7 @@ jobs:
       security-events: write
     steps:
       # TODO: replace with $/actions/scan when GitHub ships $/ syntax (#136)
-      - uses: TomHennen/wrangle/actions/scan@5d364e686de625ccb61a0fd5b12f9b25e1ab1d41 # main 2026-08-30
+      - uses: TomHennen/wrangle/actions/scan@b16076757b2b8b3088f5e918296f85fcbbe5b9b3 # main 2026-08-30
         if: ${{ inputs.scan-tools != '' }}
         with:
           checkout: "true"
diff --git a/.github/workflows/build_and_publish_npm.yml b/.github/workflows/build_and_publish_npm.yml
index 4d609251..2a198695 100644
--- a/.github/workflows/build_and_publish_npm.yml
+++ b/.github/workflows/build_and_publish_npm.yml
@@ -171,7 +171,7 @@ jobs:
       security-events: write
     steps:
       # TODO: replace with $/actions/scan when GitHub ships $/ syntax (#136)
-      - uses: TomHennen/wrangle/actions/scan@5d364e686de625ccb61a0fd5b12f9b25e1ab1d41 # main 2026-08-30
+      - uses: TomHennen/wrangle/actions/scan@b16076757b2b8b3088f5e918296f85fcbbe5b9b3 # main 2026-08-30
         if: ${{ inputs.scan-tools != '' }}
         with:
           checkout: "true"
diff --git a/.github/workflows/build_and_publish_python.yml b/.github/workflows/build_and_publish_python.yml
index a18b44d5..4ba5f8a3 100644
--- a/.github/workflows/build_and_publish_python.yml
+++ b/.github/workflows/build_and_publish_python.yml
@@ -148,7 +148,7 @@ jobs:
       security-events: write
     steps:
       # TODO: replace with $/actions/scan when GitHub ships $/ syntax (#136)
-      - uses: TomHennen/wrangle/actions/scan@5d364e686de625ccb61a0fd5b12f9b25e1ab1d41 # main 2026-08-30
+      - uses: TomHennen/wrangle/actions/scan@b16076757b2b8b3088f5e918296f85fcbbe5b9b3 # main 2026-08-30
         if: ${{ inputs.scan-tools != '' }}
         with:
           checkout: "true"
diff --git a/.github/workflows/build_shell.yml b/.github/workflows/build_shell.yml
index 5c325aec..7e025e40 100644
--- a/.github/workflows/build_shell.yml
+++ b/.github/workflows/build_shell.yml
@@ -114,7 +114,7 @@ jobs:
       security-events: write
     steps:
       # TODO: replace with $/actions/scan when GitHub ships $/ syntax (#136)
-      - uses: TomHennen/wrangle/actions/scan@5d364e686de625ccb61a0fd5b12f9b25e1ab1d41 # main 2026-08-30
+      - uses: TomHennen/wrangle/actions/scan@b16076757b2b8b3088f5e918296f85fcbbe5b9b3 # main 2026-08-30
         if: ${{ inputs.scan-tools != '' }}
         with:
           checkout: "true"
diff --git a/.github/workflows/check_source_change.yml b/.github/workflows/check_source_change.yml
index 5755a47d..8beb14c9 100644
--- a/.github/workflows/check_source_change.yml
+++ b/.github/workflows/check_source_change.yml
@@ -36,7 +36,7 @@ jobs:
       # empty and the name is just "scan".
       # TODO: replace with $/actions/scan when GitHub ships $/ syntax (#136)
       - name: Source scan
-        uses: TomHennen/wrangle/actions/scan@5d364e686de625ccb61a0fd5b12f9b25e1ab1d41 # main 2026-08-30
+        uses: TomHennen/wrangle/actions/scan@b16076757b2b8b3088f5e918296f85fcbbe5b9b3 # main 2026-08-30
         with:
           checkout: "true"
           tools: ${{ inputs.tools }}