diff --git a/.github/workflows/security-baseline.yml b/.github/workflows/security-baseline.yml
index ec16b9f..289bcaf 100644
--- a/.github/workflows/security-baseline.yml
+++ b/.github/workflows/security-baseline.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   gitleaks:
-    uses: Staros-Labs/infra/.github/workflows/reusable-security-gitleaks.yml@07dce02accd706afbcb8a8b420de0979d3f03364
+    uses: Staros-Labs/infra/.github/workflows/reusable-security-gitleaks.yml@409ae040cd95594781278724fe6a8ba2027913c0
     with:
       report_only: true
       scan_history: false
@@ -20,7 +20,7 @@ jobs:
       contents: read
 
   osv:
-    uses: Staros-Labs/infra/.github/workflows/reusable-security-osv.yml@07dce02accd706afbcb8a8b420de0979d3f03364
+    uses: Staros-Labs/infra/.github/workflows/reusable-security-osv.yml@409ae040cd95594781278724fe6a8ba2027913c0
     with:
       report_only: true
     permissions:
diff --git a/scripts/test_security_baseline_workflow.py b/scripts/test_security_baseline_workflow.py
index 83da37f..aa0ed97 100644
--- a/scripts/test_security_baseline_workflow.py
+++ b/scripts/test_security_baseline_workflow.py
@@ -11,8 +11,8 @@ def test_caller_uses_pinned_ghas_free_scanners(self) -> None:
         self.assertIn("pull_request:", text)
         self.assertIn("push:\n    branches: [main]", text)
         self.assertIn("workflow_dispatch:", text)
-        self.assertIn("Staros-Labs/infra/.github/workflows/reusable-security-gitleaks.yml@07dce02accd706afbcb8a8b420de0979d3f03364", text)
-        self.assertIn("Staros-Labs/infra/.github/workflows/reusable-security-osv.yml@07dce02accd706afbcb8a8b420de0979d3f03364", text)
+        self.assertIn("Staros-Labs/infra/.github/workflows/reusable-security-gitleaks.yml@409ae040cd95594781278724fe6a8ba2027913c0", text)
+        self.assertIn("Staros-Labs/infra/.github/workflows/reusable-security-osv.yml@409ae040cd95594781278724fe6a8ba2027913c0", text)
         self.assertEqual(text.count("report_only: true"), 2)
         self.assertNotIn("github/codeql-action", text)
         self.assertNotIn("security-events", text)