diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index fd67f2eb..dab0f42b 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -42,7 +42,7 @@ jobs:
           # No git ops after checkout; don't leave the token in .git/config.
           persist-credentials: false
       - name: Scan bun.lock for known-vulnerable / malicious dependencies
-        uses: google/osv-scanner-action/osv-scanner-action@fa4ff678dd5d0a4fa3d628e57af8162873e93cd6 # v2.3.8
+        uses: google/osv-scanner-action/osv-scanner-action@a82132c0bd6c7261ffcb78e754c46c70ab57ad9a # v2.3.8
         with:
           scan-args: |-
             --lockfile=bun.lock