diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
index b5df1d4..919be3a 100644
--- a/.github/workflows/integration.yaml
+++ b/.github/workflows/integration.yaml
@@ -142,7 +142,7 @@ jobs:
           output: sbom.json
           trivy-config: .security/trivy.yaml
       - name: Upload trivy report
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # ratchet:actions/upload-artifact@v4
         if: github.event_name == 'push' && hashFiles('sbom.json') != ''
         with:
           name: sbom-report
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 605da8a..61aaed4 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -88,7 +88,7 @@ jobs:
           trivy-config: .security/trivy.docker.yaml
 
       - name: Upload trivy report
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # ratchet:actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # ratchet:actions/upload-artifact@v4
         if: always() && hashFiles('dependency-results.sbom.json') != ''
         with:
           name: trivy-sbom-report