diff --git a/.github/workflows/fio.yml b/.github/workflows/fio.yml
index 539a222..ac03631 100644
--- a/.github/workflows/fio.yml
+++ b/.github/workflows/fio.yml
@@ -109,7 +109,7 @@ jobs:
 
       # ── Vulnerability scan (gate — before manifest merge) ─────
       - name: Trivy vulnerability scan
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         env:
           TRIVY_PLATFORM: linux/amd64
         with:
@@ -173,7 +173,7 @@ jobs:
 
       # ── Vulnerability scan (gate — before manifest merge) ─────
       - name: Trivy vulnerability scan
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         env:
           TRIVY_PLATFORM: linux/arm64
         with: