diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ac0b390..3402d73 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -135,7 +135,7 @@ jobs:
       # crates.io trusted publishing: exchange the workflow's OIDC identity
       # for a short-lived publish token (cargo does not speak OIDC itself).
       - name: Resolve the crates.io publish token (trusted publishing)
-        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
         id: auth
 
       # guard-core-rs depends on guard-core-engine, so the engine goes first