diff --git a/.github/workflows/main-validation.yml b/.github/workflows/main-validation.yml
index 6f25522..345d6b3 100644
--- a/.github/workflows/main-validation.yml
+++ b/.github/workflows/main-validation.yml
@@ -304,6 +304,6 @@ jobs:
           fi
 
       - name: Run SonarQube scan
-        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8
+        uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index 2f9451b..c4da942 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -256,7 +256,7 @@ jobs:
           fi
 
       - name: Run SonarQube scan
-        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8
+        uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           retention-days: 14
diff --git a/cmd/cmdshape-ci/release_workflow_test.go b/cmd/cmdshape-ci/release_workflow_test.go
index 3d557a2..cbd033e 100644
--- a/cmd/cmdshape-ci/release_workflow_test.go
+++ b/cmd/cmdshape-ci/release_workflow_test.go
@@ -140,7 +140,7 @@ var _ = Describe("validation workflow dependencies", func() {
 			Expect(workflow).NotTo(ContainSubstring("go install "))
 			Expect(workflow).NotTo(ContainSubstring("raw.githubusercontent.com/golangci"))
 			Expect(workflow).To(ContainSubstring(
-				"uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8",
+				"uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8",
 			))
 			Expect(workflow).NotTo(ContainSubstring("uses: SonarSource/sonarqube-scan-action@v8"))
 		},