diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 95f8fbfb..48e3682b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -994,7 +994,7 @@ jobs:
         # Pinned by commit like every other action here. The scan is evidence,
         # not the document: its job is to ask whether the built binaries contain
         # something the registry does not know about.
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26  # v0.24.0
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c  # v0.24.0
         with:
           path: dist
           format: syft-json