diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f1ea4200..ae958294 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -107,7 +107,7 @@ jobs:
           semgrep scan --error --config p/python --config p/owasp-top-ten \
             api/src/ sync-service/src/ ml-service/src/
       - name: SBOM (CycloneDX via syft)
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           path: .
           artifact-name: pulsebase-sbom.cdx.json
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 90aee014..3e0b01ca 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Install Syft
-        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26  # v0.24.2
+        uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c  # v0.24.3
 
       - name: Generate SBOM
         run: syft dir:. -o cyclonedx-json=sbom.cdx.json