diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a08e92b20c..cb70d3abc5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -189,7 +189,7 @@ jobs:
 
       # syft binary that .goreleaser.yml's sboms: block shells out to.
       - name: "Install syft"
-        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
 
       - name: "Run goreleaser release"
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
@@ -244,7 +244,7 @@ jobs:
       # from .goreleaser.yml's per-archive sboms: block (bound to individual
       # archives, uploaded to the release directly by GoReleaser itself).
       - name: "Generate and attest source-tree SBOM"
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           path: .
           format: spdx-json