diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 766c9116..fc5561c8 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -99,7 +99,7 @@ jobs:
         mkdir -p output
         helm template ./deploy --namespace ocm-system --set "manager.image.tag=${{ env.RELEASE_VERSION }}" --include-crds > ./output/install.yaml
     - name: Setup Syft
-      uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
+      uses: anchore/sbom-action/download-syft@9f7302141466aa6482940f15371237e9d9f4c34a # v0.19.0
     - name: Setup Cosign
       uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb
     - name: Run goreleaser