diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 6bae36fd..39b75916 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -106,7 +106,7 @@ jobs:
           echo "✅ Docker Scout security gate passed"
 
       - name: Trivy security scan
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # master
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # master
         with:
           image-ref: local-scan:latest
           format: table
@@ -117,7 +117,7 @@ jobs:
 
       - name: Trivy SARIF upload
         if: always()
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # master
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # master
         with:
           image-ref: local-scan:latest
           format: sarif
diff --git a/.github/workflows/security-update.yml b/.github/workflows/security-update.yml
index dfc5bdad..06f3e8e5 100644
--- a/.github/workflows/security-update.yml
+++ b/.github/workflows/security-update.yml
@@ -44,7 +44,7 @@ jobs:
 
       # Run SARIF scan first (non-blocking) to always generate the file
       - name: Run Trivy scanner for SARIF output
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
         with:
           image-ref: security-test:latest
           format: "sarif"
@@ -63,7 +63,7 @@ jobs:
 
       # Run table scan (blocking) after SARIF is uploaded
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
         with:
           image-ref: security-test:latest
           format: "table"