diff --git a/.github/workflows/app-builder.yaml b/.github/workflows/app-builder.yaml
index fa932c5b2..8ffaf92f8 100644
--- a/.github/workflows/app-builder.yaml
+++ b/.github/workflows/app-builder.yaml
@@ -266,7 +266,7 @@ jobs:
           password: ${{ github.token }}
 
       - name: Upload Dependency Snapshot
-        uses: anchore/sbom-action@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           dependency-snapshot: true
           image: ghcr.io/${{ github.repository_owner }}/${{ inputs.app }}@${{ needs.merge.outputs.digest }}
diff --git a/.github/workflows/vulnerability-scan.yaml b/.github/workflows/vulnerability-scan.yaml
index 15453704e..3e40f83df 100644
--- a/.github/workflows/vulnerability-scan.yaml
+++ b/.github/workflows/vulnerability-scan.yaml
@@ -44,7 +44,7 @@ jobs:
 
       - if: ${{ always() && steps.database-restore.outputs.cache-hit != 'true' }}
         name: Install Grype
-        uses: anchore/scan-action/download-grype@8964e60c6fabdb85fdbbbfd9834d8f19c97a3086 # v7.4.1
+        uses: anchore/scan-action/download-grype@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
         id: grype
 
       - if: ${{ always() && steps.database-restore.outputs.cache-hit != 'true' }}
@@ -88,7 +88,7 @@ jobs:
           path: ~/.cache/grype/db
 
       - name: Scan
-        uses: anchore/scan-action@8964e60c6fabdb85fdbbbfd9834d8f19c97a3086 # v7.4.1
+        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
         id: scan
         with:
           fail-build: false