diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml
index ea95b84..d3fccf5 100644
--- a/.github/workflows/quality-gates.yml
+++ b/.github/workflows/quality-gates.yml
@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
     # attested-delivery/.github main @ ca91728 (2026-07-12)
-    uses: attested-delivery/.github/.github/workflows/pin-check.yml@ca91728c87beb08742325b4ed4d06fcfb261435b
+    uses: attested-delivery/.github/.github/workflows/pin-check.yml@78f1933ef020e3d94af848a191297d26e8dc8b4c
 
   # SAST — CodeQL (Go). Go has no "none" build mode (unlike Rust/JS) — it
   # only supports autobuild or manual, so this must build the module.