diff --git a/.github/workflows/bridge-release.yml b/.github/workflows/bridge-release.yml
index e04dffd..c6de076 100644
--- a/.github/workflows/bridge-release.yml
+++ b/.github/workflows/bridge-release.yml
@@ -144,7 +144,7 @@ jobs:
       # Phase 6.1 — CycloneDX SBOM for the bridge source tree. Attached
       # to the GH release alongside the binaries.
       - name: Generate CycloneDX SBOM
-        uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0  # pin v0.18.0
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # pin v0.24.0
         with:
           path: bridge
           format: cyclonedx-json
diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml
index aa040ba..0638541 100644
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@@ -282,7 +282,7 @@ jobs:
       # procurement checkbox. Uses Syft under the hood via Anchore's
       # reusable action.
       - name: Generate CycloneDX SBOM
-        uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0  # pin v0.18.0
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # pin v0.24.0
         with:
           path: cli
           format: cyclonedx-json
diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
index 99f8125..6b56585 100644
--- a/.github/workflows/python-release.yml
+++ b/.github/workflows/python-release.yml
@@ -136,7 +136,7 @@ jobs:
         run: mkdir -p publishers/python/sbom
 
       - name: Generate CycloneDX SBOM
-        uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0  # pin v0.18.0
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # pin v0.24.0
         with:
           path: publishers/python
           format: cyclonedx-json