diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index cdeb236d4..862296e9f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -55,7 +55,7 @@ jobs:
           go-version: '>=1.19.4'
           cache: true
       - uses: sigstore/cosign-installer@v2.8.1
-      - uses: anchore/sbom-action/download-syft@v0.13.2
+      - uses: anchore/sbom-action/download-syft@v0.13.3
       - name: setup-validate-krew-manifest
         run: go install sigs.k8s.io/krew/cmd/validate-krew-manifest@latest
       - name: setup-tparse
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 19bc6c05e..d9bf28bab 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -98,7 +98,7 @@ jobs:
             ./dist/*.apk
           key: ${{ github.ref }}
       - uses: sigstore/cosign-installer@v2.8.1
-      - uses: anchore/sbom-action/download-syft@v0.13.2
+      - uses: anchore/sbom-action/download-syft@v0.13.3
       - name: dockerhub-login
         if: startsWith(github.ref, 'refs/tags/v')
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v1