diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d5b8eac2..98f95b74 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -52,7 +52,7 @@ jobs:
           git config user.email "endive@bytecodealliance.org"
 
       - name: Install ORAS
-        uses: oras-project/setup-oras@v1
+        uses: oras-project/setup-oras@v2
 
       # Jars must be built against an immutable wasm tag: the development
       # snapshot is mutable, so a release built against it stops being
diff --git a/.github/workflows/wasm-publish.yaml b/.github/workflows/wasm-publish.yaml
index d101f71a..2910ef27 100644
--- a/.github/workflows/wasm-publish.yaml
+++ b/.github/workflows/wasm-publish.yaml
@@ -50,7 +50,7 @@ jobs:
         run: make all
 
       - name: Install ORAS
-        uses: oras-project/setup-oras@v1
+        uses: oras-project/setup-oras@v2
 
       - name: Login to GHCR
         run: echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io -u ${{ github.actor }} --password-stdin