diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 6789b37f..3b193d6a 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -56,7 +56,7 @@ jobs:
       # `audit-check` above covers advisories only. This adds the three checks a repo with this
       # much crypto surface wants: banned/duplicate crates, licence policy, and source
       # allowlisting. Config lives in deny.toml, next to Cargo.toml.
-      - uses: EmbarkStudios/cargo-deny-action@b66acf5e9fe20f8aba065be86778a8a4c846f902 # v2
+      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
         with:
           command: check