diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
index 3a57b70..9b390d2 100644
--- a/.github/workflows/cd.yaml
+++ b/.github/workflows/cd.yaml
@@ -278,4 +278,4 @@ jobs:
         # Jobs) that previously only the system-test path emitted. kubectl uses
         # the Talos cert-based admin@prod kubeconfig, so no HCLOUD_TOKEN is
         # needed by the diagnostics themselves.
-        uses: devantler-tech/actions/diagnose-flux@5de934e076503c897d43d85680406f8d1d9356b7 # v10.0.0
+        uses: devantler-tech/actions/diagnose-flux@9705e47d7df0b556ec06786247297c0e5020e56d # v10.2.1
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3de1b8a..ab3d252 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -132,7 +132,7 @@ jobs:
         # Shared composite — single source of truth for Flux failure diagnostics
         # (devantler-tech/actions#367). Default kustomizations match this job's
         # previous inline list (infrastructure-controllers infrastructure apps).
-        uses: devantler-tech/actions/diagnose-flux@5de934e076503c897d43d85680406f8d1d9356b7 # v10.0.0
+        uses: devantler-tech/actions/diagnose-flux@9705e47d7df0b556ec06786247297c0e5020e56d # v10.2.1
 
       - name: 🔥 Delete cluster
         if: always()
@@ -331,7 +331,7 @@ jobs:
         # Jobs) that previously only the system-test path emitted. kubectl uses
         # the Talos cert-based admin@prod kubeconfig, so no HCLOUD_TOKEN is
         # needed by the diagnostics themselves.
-        uses: devantler-tech/actions/diagnose-flux@5de934e076503c897d43d85680406f8d1d9356b7 # v10.0.0
+        uses: devantler-tech/actions/diagnose-flux@9705e47d7df0b556ec06786247297c0e5020e56d # v10.2.1
 
   ci-required-checks:
     name: CI - Required Checks