diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f420196..76c3d32 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -90,7 +90,7 @@ jobs:
           cache: pnpm
           cache-dependency-path: cdk/pnpm-lock.yaml
 
-      - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
+      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
           aws-region: us-east-2
@@ -174,7 +174,7 @@ jobs:
           # API_BASE resolves to '' in production builds (web/src/config.ts) —
           # same origin as the tiles and weather feeds, so all fetches relative.
           BASE_PATH: /
-      - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
+      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
           aws-region: us-east-2