diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5298a60..fd6b1561 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -602,7 +602,7 @@ jobs:
           metadata.unlink()
           PY
       - name: Generate whole-image SBOM
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           image: engraphis:release
           format: cyclonedx-json
diff --git a/tests/test_release_evidence.py b/tests/test_release_evidence.py
index 82aa020a..a9ac44ca 100644
--- a/tests/test_release_evidence.py
+++ b/tests/test_release_evidence.py
@@ -1264,7 +1264,11 @@ def test_release_workflow_publishes_complete_captured_evidence():
     assert "installed-journey.json" in platform_smoke
     assert '"pip", "check"' in platform_smoke
     assert "scripts.smoke_entry_points" in platform_smoke
-    assert "anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26" in docker_job
+    assert re.search(
+        r"uses: anchore/sbom-action@[0-9a-f]{40} # v\d+\.\d+\.\d+\s*$",
+        docker_job,
+        flags=re.MULTILINE,
+    )
     assert "anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439" in docker_job
     assert "docker buildx build --pull --load" in docker_job
     assert '"containerimage.digest"' in docker_job