diff --git a/.github/workflows/registry.yml b/.github/workflows/registry.yml
index 5ff2284a3..587681c11 100644
--- a/.github/workflows/registry.yml
+++ b/.github/workflows/registry.yml
@@ -109,7 +109,7 @@ jobs:
 
       - name: Generate SBOM for Vela Core Image
         id: generate_vela_core_sbom
-        uses: anchore/sbom-action@v0.17.0
+        uses: anchore/sbom-action@v0.24.0
         with:
           image: ghcr.io/${{ github.repository_owner }}/oamdev/vela-core:${{ steps.get_version.outputs.VERSION }}
           registry-username: ${{ github.actor }}
@@ -166,7 +166,7 @@ jobs:
 
       - name: Generate SBOM for Vela CLI Image
         id: generate_sbom
-        uses: anchore/sbom-action@v0.17.0
+        uses: anchore/sbom-action@v0.24.0
         with:
           image: ghcr.io/${{ github.repository_owner }}/oamdev/vela-cli:${{ steps.get_version.outputs.VERSION }}
           registry-username: ${{ github.actor }}
@@ -191,7 +191,7 @@ jobs:
           docker.io/oamdev/vela-cli@${{ steps.meta-vela-cli.outputs.digest }}
 
       - name: Publish SBOMs as release artifacts
-        uses: anchore/sbom-action/publish-sbom@v0.17.0
+        uses: anchore/sbom-action/publish-sbom@v0.24.0
 
   provenance-ghcr:
     name: Generate and Push Provenance to GCHR
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e13e73faa..4fcd30201 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -72,7 +72,7 @@ jobs:
           cosign-release: "v2.5.0"
 
       - name: Install syft
-        uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0