diff --git a/.github/workflows/validate-pr-vulnerabilities.yml b/.github/workflows/validate-pr-vulnerabilities.yml
index e4534cae..4fdc176d 100644
--- a/.github/workflows/validate-pr-vulnerabilities.yml
+++ b/.github/workflows/validate-pr-vulnerabilities.yml
@@ -24,7 +24,7 @@ jobs:
 
       - name: Scan dependencies, IaC and secrets
         # Pinned to a commit: the action's tags are mutable.
-        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           scanners: vuln,misconfig,secret
@@ -38,6 +38,6 @@ jobs:
       - name: Upload results to the Security tab
         # Fork PRs get a read-only token, so the upload cannot run there.
         if: always() && github.event.pull_request.head.repo.full_name == github.repository
-        uses: github/codeql-action/upload-sarif@8498dc4c2b27cdd99baf0f87955b29ebbf30c78d # v4.39.1
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: trivy.sarif