diff --git a/.changeset/patch-remove-vulnerable-awf-0-27-44-agent-pin.md b/.changeset/patch-remove-vulnerable-awf-0-27-44-agent-pin.md
new file mode 100644
index 00000000000..7a8ed273450
--- /dev/null
+++ b/.changeset/patch-remove-vulnerable-awf-0-27-44-agent-pin.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Remove vulnerable `ghcr.io/github/gh-aw-firewall/agent:0.27.44` container image pin from shared action lock data. The image digest `sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4` is flagged by daily container scanning for High severity Node.js CVEs (CVE-2026-56846, CVE-2026-56848, CVE-2026-58043) and npm dependency advisories in `brace-expansion` and `ip-address`. The default firewall version is already `v0.28.1`; removing this historical agent pin prevents the vulnerable digest from being resolved from embedded lock metadata.
diff --git a/.github/aw/actions-lock.json b/.github/aw/actions-lock.json
index 364eae6ba26..2306d516e71 100644
--- a/.github/aw/actions-lock.json
+++ b/.github/aw/actions-lock.json
@@ -165,11 +165,6 @@
     }
   },
   "containers": {
-    "ghcr.io/github/gh-aw-firewall/agent:0.27.44": {
-      "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.44",
-      "digest": "sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4"
-    },
     "ghcr.io/github/gh-aw-firewall/agent:0.28.1": {
       "image": "ghcr.io/github/gh-aw-firewall/agent:0.28.1",
       "digest": "sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d",
diff --git a/pkg/actionpins/data/action_pins.json b/pkg/actionpins/data/action_pins.json
index 364eae6ba26..2306d516e71 100644
--- a/pkg/actionpins/data/action_pins.json
+++ b/pkg/actionpins/data/action_pins.json
@@ -165,11 +165,6 @@
     }
   },
   "containers": {
-    "ghcr.io/github/gh-aw-firewall/agent:0.27.44": {
-      "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.44",
-      "digest": "sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4"
-    },
     "ghcr.io/github/gh-aw-firewall/agent:0.28.1": {
       "image": "ghcr.io/github/gh-aw-firewall/agent:0.28.1",
       "digest": "sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d",
diff --git a/pkg/workflow/data/action_pins.json b/pkg/workflow/data/action_pins.json
index 364eae6ba26..2306d516e71 100644
--- a/pkg/workflow/data/action_pins.json
+++ b/pkg/workflow/data/action_pins.json
@@ -165,11 +165,6 @@
     }
   },
   "containers": {
-    "ghcr.io/github/gh-aw-firewall/agent:0.27.44": {
-      "image": "ghcr.io/github/gh-aw-firewall/agent:0.27.44",
-      "digest": "sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.27.44@sha256:0d727725c737b58c7bdf51f640cffb928385ec46517e0917c7f1a02f1bada8b4"
-    },
     "ghcr.io/github/gh-aw-firewall/agent:0.28.1": {
       "image": "ghcr.io/github/gh-aw-firewall/agent:0.28.1",
       "digest": "sha256:5e3f6ee27eeae07195838b97ac4aa2f8aea42a7c55f1c0d3e17d8e88e294ad0d",