diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 143cacb..667302a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,7 +54,7 @@ jobs:
           cache: true
 
       # syft powers GoReleaser's SBOM generation.
-      - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+      - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
 
       # `go install` needs a tag named after the module's subdirectory: the
       # module is github.com/simtabi/ssh-manager/src/v3, so Go looks for