diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 433af83..130de38 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -66,7 +66,7 @@ jobs:
           output-file: facet-sbom.spdx.json
 
       - name: Attest SBOM
-        uses: actions/attest-sbom@bd218ad0dbcb3e146bd073d1d9c6d78e08aa8a0b # v2
+        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
         with:
           subject-path: 'dist-tarballs/*.tgz'
           sbom-path: facet-sbom.spdx.json