diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2e6a22b..fa02a5a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,7 +42,7 @@ jobs:
     steps:
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: { path: dist, merge-multiple: true }
-      - uses: anchore/sbom-action@55dc4ee22412511ee8c3142cbea40418e6cec693 # v0.17.8
+      - uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with: { path: dist, format: spdx-json, output-file: dist/kaasu.spdx.json }
       # The SBOM is listed in SHA256SUMS, and SHA256SUMS is signed, so the SBOM is authenticated too.
       - name: Checksums