diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml
index 47fe2a1..43ab5df 100644
--- a/.github/workflows/release-policy.yml
+++ b/.github/workflows/release-policy.yml
@@ -156,7 +156,7 @@ jobs:
 
       - name: Attest build provenance (policy.json)
         if: env.MODE == 'enforced'
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: policy-release/policy.json