diff --git a/.github/workflows/release-snapshot.yml b/.github/workflows/release-snapshot.yml
index 6401f87..68c1883 100644
--- a/.github/workflows/release-snapshot.yml
+++ b/.github/workflows/release-snapshot.yml
@@ -65,7 +65,7 @@ jobs:
       # Fork PR: skip sign (no OIDC token); SBOM still works.
       - name: Goreleaser snapshot (same-repo)
         if: github.event.pull_request.head.repo.fork == false
-        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           distribution: goreleaser
           version: latest
@@ -76,7 +76,7 @@ jobs:
 
       - name: Goreleaser snapshot (fork PR — skip sign)
         if: github.event.pull_request.head.repo.fork == true
-        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           distribution: goreleaser
           version: latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a9dadb5..be64a46 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -70,7 +70,7 @@ jobs:
       # specter/.goreleaser.yml sboms: block).
       - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
 
-      - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
+      - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           distribution: goreleaser
           version: latest