diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index d60db1f1..8f7901aa 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -31,7 +31,7 @@ jobs:
           go-version-file: 'go.mod'
           check-latest: true
 
-      - uses: chainguard-dev/actions/goimports@de68b87302e6266db5fb5220246f8aa46fe94b67 # v1.6.14
+      - uses: chainguard-dev/actions/goimports@061bc0e921116bde1470f51fb5c86d5318f16558 # v1.6.15
       - run: make wolfictl
       - run: make test
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b728d9b0..8fc0fa07 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -73,7 +73,7 @@ jobs:
           fi
 
       - name: Bump and push Git tag
-        uses: chainguard-dev/actions/git-tag@de68b87302e6266db5fb5220246f8aa46fe94b67 # v1.6.14
+        uses: chainguard-dev/actions/git-tag@061bc0e921116bde1470f51fb5c86d5318f16558 # v1.6.15
         if: steps.check.outputs.bump == 'yes'
         with:
           token: ${{ steps.octo-sts.outputs.token }}