diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 424653c..0465e09 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
       - name: Vet and test
         run: just vet test
       - name: Check the version stamp
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           version: "~> v2"
           args: build --clean --single-target --id saladcloud --output dist/check/saladcloud
@@ -80,7 +80,7 @@ jobs:
       - name: Install syft (SBOMs)
         uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
       - name: Release
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           version: "~> v2"
           args: release --clean
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5bdd728..2be52c3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -87,7 +87,7 @@ jobs:
         # so the installed binary's version can be checked against its archive.
         run: git tag v0.0.0-ci
       - name: package with goreleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         env:
           # A commit that also carries a real v* tag (main right after a
           # release) would otherwise be packaged under that tag.