diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2a6207e..65ec63d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -168,7 +168,7 @@ jobs:
           echo "::endgroup::"
 
       - name: Install slsa-verifier
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: '1.22'
       - run: go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@v2.7.0