diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0e0cbd7..05d34dc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -77,7 +77,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89  # v7
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94  # v7
         with:
           version: "~> v2"
           args: check
@@ -112,7 +112,7 @@ jobs:
           go-version-file: go.mod
           cache: true
 
-      - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89  # v7
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94  # v7
         if: steps.changes.outputs.goreleaser == 'true'
         with:
           version: "~> v2"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b390f0d..21cb358 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,7 +41,7 @@ jobs:
 
       - name: Release (tag push)
         if: github.event_name == 'push'
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89  # v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94  # v7
         with:
           version: "~> v2"
           args: release --clean --skip=homebrew,scoop
@@ -57,7 +57,7 @@ jobs:
 
       - name: Release (manual)
         if: github.event_name == 'workflow_dispatch'
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89  # v7
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94  # v7
         with:
           version: "~> v2"
           args: release --clean --skip=homebrew,scoop
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59eee46..05e758f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ under the affected version with a reference to the CVE or advisory.
 
 ### Changed
 - Bump `google.golang.org/grpc` from 1.81.1 to 1.82.0 (routine minor release; transitive bump to `google.golang.org/genproto/googleapis/rpc`)
+- Bump `goreleaser/goreleaser-action` from 7.2.2 to 7.2.3 (CI/release: pinned SHA update across ci.yml and release.yml)
 
 ---