diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
old mode 100755
new mode 100644
index 93135a6..08012ef
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -63,7 +63,7 @@ jobs:
           fi
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           name: ${{ github.ref_name }}
           body_path: release-notes.md # avoids YAML special-char injection
@@ -149,7 +149,7 @@ jobs:
           sha256sum code-review-cli-${{ matrix.platform }} > code-review-cli-${{ matrix.platform }}.sha256
 
       - name: Publish to GitHub Releases
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: |
             code-review-cli-${{ matrix.platform }}
@@ -217,7 +217,7 @@ jobs:
           shasum -a 256 code-review-cli-${{ matrix.platform }} > code-review-cli-${{ matrix.platform }}.sha256
 
       - name: Publish to GitHub Releases
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: |
             code-review-cli-${{ matrix.platform }}
@@ -264,7 +264,7 @@ jobs:
           if ($out -notmatch "AI Code Reviewer") { Write-Host "::error::Binary did not print the startup banner"; exit 1 }
 
       - name: Publish to GitHub Releases
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: |
             code-review-cli-windows-amd64.exe