diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
index 8efd0ee..0995895 100644
--- a/.github/workflows/cd.yaml
+++ b/.github/workflows/cd.yaml
@@ -278,4 +278,4 @@ jobs:
         # Jobs) that previously only the system-test path emitted. kubectl uses
         # the Talos cert-based admin@prod kubeconfig, so no HCLOUD_TOKEN is
         # needed by the diagnostics themselves.
-        uses: devantler-tech/actions/diagnose-flux@6a2f24aa5a859f7d0de66f9d0bde52254adba641 # v7.1.3
+        uses: devantler-tech/actions/diagnose-flux@b69839ba2debe04a46321b7698b6daf57667d4e7 # v9.0.2
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1cefeed..b9315aa 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -101,7 +101,7 @@ jobs:
         # Shared composite — single source of truth for Flux failure diagnostics
         # (devantler-tech/actions#367). Default kustomizations match this job's
         # previous inline list (infrastructure-controllers infrastructure apps).
-        uses: devantler-tech/actions/diagnose-flux@6a2f24aa5a859f7d0de66f9d0bde52254adba641 # v7.1.3
+        uses: devantler-tech/actions/diagnose-flux@b69839ba2debe04a46321b7698b6daf57667d4e7 # v9.0.2
 
       - name: 🔥 Delete cluster
         if: always()
@@ -300,7 +300,7 @@ jobs:
         # Jobs) that previously only the system-test path emitted. kubectl uses
         # the Talos cert-based admin@prod kubeconfig, so no HCLOUD_TOKEN is
         # needed by the diagnostics themselves.
-        uses: devantler-tech/actions/diagnose-flux@6a2f24aa5a859f7d0de66f9d0bde52254adba641 # v7.1.3
+        uses: devantler-tech/actions/diagnose-flux@b69839ba2debe04a46321b7698b6daf57667d4e7 # v9.0.2
 
   ci-required-checks:
     name: CI - Required Checks