diff --git a/.github/workflows/release-skill.yml b/.github/workflows/release-skill.yml
index 918e132..47c73e3 100644
--- a/.github/workflows/release-skill.yml
+++ b/.github/workflows/release-skill.yml
@@ -42,7 +42,7 @@ jobs:
           cp test-vectors/good/pack-sign-roundtrip/signatures.json dist/signatures.json
 
       - name: Install ORAS
-        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6
+        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3
 
       - name: Install Syft
         uses: anchore/sbom-action/download-syft@28d71544de8eaf1b958d335707167c5f783590ad