diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0e0cbd7..dbf9440 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706  # v4.0.2
         id: changes
         with:
           filters: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59eee46..9a2c692 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ under the affected version with a reference to the CVE or advisory.
 ## [Unreleased]
 
 ### Changed
+- Bump `dorny/paths-filter` from 4.0.1 to 4.0.2 (CI: pinned SHA update)
 - Bump `google.golang.org/grpc` from 1.81.1 to 1.82.0 (routine minor release; transitive bump to `google.golang.org/genproto/googleapis/rpc`)
 
 ---