diff --git a/.github/workflows/plumber.yml b/.github/workflows/plumber.yml
index be6a051..7bac486 100644
--- a/.github/workflows/plumber.yml
+++ b/.github/workflows/plumber.yml
@@ -52,7 +52,7 @@ jobs:
           persist-credentials: false
 
       - name: Plumber compliance scan
-        uses: getplumber/plumber@fdd2a2d0555bb3b33cbb2efff3b955dea5a6bbf0 # v0.4.3
+        uses: getplumber/plumber@ef9864df81f444647d95889d98695434f6fa9732 # v0.4.12
         with:
           version: "v0.4.3"
           verify-attestation: "true"   # check the binary's SLSA provenance before running