diff --git a/.github/workflows/osvscanner.yml b/.github/workflows/osvscanner.yml
index 806c8086..d0dab8c7 100644
--- a/.github/workflows/osvscanner.yml
+++ b/.github/workflows/osvscanner.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.event_name == 'pull_request'
     # Companion SCA lane for manifest evidence. Central .github still owns the
     # required review/security/scheduler workflows.
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@3a7550f43ba5b58905a821ce3a0ed24c4858b3f4 # v2.3.8 + export-results gate
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@f4cfcc01edc9c8b756a9b873b7a623ca674da51e # v2.5.0 + export-results gate
     permissions:
       actions: read
       contents: read