diff --git a/.github/tests/test-publish-manifests-promotion.sh b/.github/tests/test-publish-manifests-promotion.sh
index bd988e61..2c25335d 100644
--- a/.github/tests/test-publish-manifests-promotion.sh
+++ b/.github/tests/test-publish-manifests-promotion.sh
@@ -6,7 +6,7 @@ set -euo pipefail
 validate_caller() {
   yq -e '
   (.jobs["publish-manifests"].uses ==
-    "devantler-tech/.github/.github/workflows/publish-manifests.yaml@e1681322e671f8e277c5e230a57fe66cdf1a612d") and
+    "devantler-tech/.github/.github/workflows/publish-manifests.yaml@8d2203af130a8c27b8b98b3d7146f76b5ade7a98") and
   (.jobs["publish-manifests"].with["enable-caller-pin"] == true) and
   (.jobs["publish-manifests"].with["enable-signed-promotion"] == true) and
   (.jobs["publish-manifests"].with["oci-name"] == "devantler-tech/github-config")
diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
index de30919b..e760fc97 100644
--- a/.github/workflows/cd.yaml
+++ b/.github/workflows/cd.yaml
@@ -38,7 +38,7 @@ jobs:
     # ecosystem, no cooldown for devantler-tech/*).
     # Keep the ref a 40-hex commit: it is part of the cosign subject the platform
     # verifies, so its shape is load-bearing here.
-    uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@e1681322e671f8e277c5e230a57fe66cdf1a612d # v7.12.0
+    uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@8d2203af130a8c27b8b98b3d7146f76b5ade7a98 # v7.16.2
     with:
       oci-name: devantler-tech/github-config
       # Without this, a ref the platform verifier does not accept fails nothing