diff --git a/Makefile b/Makefile
index f6cb595..26ff8ba 100644
--- a/Makefile
+++ b/Makefile
@@ -45,7 +45,7 @@ BIN_DIR := $(CURDIR)/bin
 # pin (see .github/workflows/ci.yml). Always a fully-signed published release —
 # never "latest" and never the in-flight cut — so main CI cannot 404 during the
 # tag/upload window. Advance after each release publishes + signs.
-SFETCH_VERSION := v0.4.8
+SFETCH_VERSION := v0.4.9
 GONEAT_VERSION ?= v0.5.15
 GOVULNCHECK_VERSION ?= v1.6.0