diff --git a/.github/workflows/nightly-oras.yml b/.github/workflows/nightly-oras.yml
index e09908d..cdc5476 100644
--- a/.github/workflows/nightly-oras.yml
+++ b/.github/workflows/nightly-oras.yml
@@ -129,7 +129,7 @@ jobs:
           path: .
 
       - name: Install ORAS
-        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
 
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
diff --git a/.github/workflows/release-oras.yml b/.github/workflows/release-oras.yml
index 0ad676d..05c5853 100644
--- a/.github/workflows/release-oras.yml
+++ b/.github/workflows/release-oras.yml
@@ -108,7 +108,7 @@ jobs:
           path: .
 
       - name: Install ORAS
-        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
 
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2