diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 35f0f51f..03d8e12d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -99,7 +99,7 @@ jobs:
         mkdir -p output
         helm template ./deploy --namespace ocm-system --set "manager.image.tag=${{ env.RELEASE_VERSION }}" --include-crds > ./output/install.yaml
     - name: Setup Syft
-      uses: anchore/sbom-action/download-syft@7b36ad622f042cab6f59a75c2ac24ccb256e9b45 # v0.20.4
+      uses: anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c # v0.20.5
     - name: Setup Cosign
       uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159
     - name: Run goreleaser