diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 2631a6d..d1cb52e 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -100,7 +100,7 @@ jobs:
         run: ./target/release/truent symbolic examples/foundry --format json --out symbolic.json || true
       - name: Scan with SARIF for code scanning
         run: ./target/release/truent scan . --chain auto --sarif truent.sarif --output json > /dev/null || true
-      - uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
+      - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v3
         if: always()
         with:
           sarif_file: truent.sarif