diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9823ec4..4346da4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -165,7 +165,7 @@ jobs:
         # container at the version matching this SHA pin (report-0.6.1, read
         # from package.json at the pinned commit) — the release path never
         # picks up a floating image.
-        uses: no42-org/blitsbom@bcd6d108886dbc0457794a5c3a20551073ac064f # v0.8.4
+        uses: no42-org/blitsbom@6236fb7f3a3ddce56557e33fb351fbf1a8262bf1 # v0.8.4
         with:
           sbom: sbom/onmsctl.cdx.json
           output: sbom/onmsctl-sbom-report.html