diff --git a/.github/workflows/mirror-trivy-db.yaml b/.github/workflows/mirror-trivy-db.yaml
index d5f6e02..6407b91 100644
--- a/.github/workflows/mirror-trivy-db.yaml
+++ b/.github/workflows/mirror-trivy-db.yaml
@@ -60,7 +60,7 @@ jobs:
       matrix: ${{ fromJson(needs.resolve.outputs.matrix) }}
     steps:
       - name: Install oras
-        uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
 
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2