diff --git a/.github/actions/scan/action.yml b/.github/actions/scan/action.yml
index 7eada7a..fe32121 100644
--- a/.github/actions/scan/action.yml
+++ b/.github/actions/scan/action.yml
@@ -88,11 +88,11 @@ runs:
         # shellcheck disable=SC2086
         if [ "$RUNNER_OS" = Linux ]; then
           docker run --rm -e GH_TOKEN -v "$PWD:/repo:ro" \
-            ghcr.io/zizmorcore/zizmor:1.30.1@sha256:a2eb396d886c053073405c7a980f2139ba2248ec172243cfa3841e57196e8101 \
+            ghcr.io/zizmorcore/zizmor:1.31.1@sha256:42d409dbb851d4c5d35a058cf042b828bea1e3f2884378c526eb0974780e18d9 \
             $ZIZMOR_ARGS /repo
         else
           zizmor="$("$GITHUB_ACTION_PATH/install.sh" zizmor \
-            ARM64 zizmorcore/zizmor@v1.30.1 'zizmor-aarch64-apple-darwin.tar.gz' sha256:e28d22b087f9ebb8d99da6e740d348c930f559961c7c3f12badda54f882195a2 \
-            X64 zizmorcore/zizmor@v1.30.1 'zizmor-x86_64-apple-darwin.tar.gz' sha256:10e6b18b11ea07e515a16f0f0518c7b07527bc9977c1fd5698181ce7f3554202)"
+            ARM64 zizmorcore/zizmor@v1.31.1 'zizmor-aarch64-apple-darwin.tar.gz' sha256:ad5aa633cd56215b11e6c51d51f90c7e6b22904a75047d1215abbd422f61d698 \
+            X64 zizmorcore/zizmor@v1.31.1 'zizmor-x86_64-apple-darwin.tar.gz' sha256:72ae63bb85b67229c06242f04195cb43927e9fab5f43803c6434dc701a517d61)"
           "$zizmor" $ZIZMOR_ARGS .
         fi
diff --git a/mise.toml b/mise.toml
index 0b7af8b..d40075d 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,6 +1,6 @@
 [tools]
 actionlint = "1.7.12"
-"pipx:zizmor" = "1.30.1"
+"pipx:zizmor" = "1.31.1"
 
 [tasks.verify-pins]
 description = "Fail when one tool's pins name different versions"