diff --git a/.github/workflows/go-build-and-test.yaml b/.github/workflows/go-build-and-test.yaml
index d64f059..2e73316 100644
--- a/.github/workflows/go-build-and-test.yaml
+++ b/.github/workflows/go-build-and-test.yaml
@@ -27,7 +27,7 @@ jobs:
 
     - name: Determine Go versions
       id: versions
-      uses: carabiner-dev/actions/go/versions@d41fe10fe88deaf493ce026007da73738b9f570c # main
+      uses: carabiner-dev/actions/go/versions@63d43b57262e65927864c8f7ca0a6a8efe06acc0 # main
 
   test:
     needs: go-versions
diff --git a/.github/workflows/golangci-lint.yaml b/.github/workflows/golangci-lint.yaml
index cdd6986..9b90dfd 100644
--- a/.github/workflows/golangci-lint.yaml
+++ b/.github/workflows/golangci-lint.yaml
@@ -26,7 +26,7 @@ jobs:
 
       - name: Determine Go versions
         id: versions
-        uses: carabiner-dev/actions/go/versions@d41fe10fe88deaf493ce026007da73738b9f570c # main
+        uses: carabiner-dev/actions/go/versions@63d43b57262e65927864c8f7ca0a6a8efe06acc0 # main
 
   golangci:
     needs: resolve-versions
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e970524..71600c8 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -50,7 +50,7 @@ jobs:
 
       - name: Generate SBOM
         id: sbom
-        uses: carabiner-dev/actions/unpack/sbom@d41fe10fe88deaf493ce026007da73738b9f570c # v1.3.0
+        uses: carabiner-dev/actions/unpack/sbom@63d43b57262e65927864c8f7ca0a6a8efe06acc0 # v1.3.1
         with:
           push-to-release: ${{ steps.tag.outputs.tag_name }}
           # goreleaser's proxy mode leaves a synthesized Go module under