diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 203a3e0..425a2fc 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
       - run: uvx semgrep@1.178.0 scan --config p/default --metrics=off --error .
 
   # pip-audit rather than osv-scanner: there is no lockfile, and osv-scanner