diff --git a/.github/workflows/airlock.yml b/.github/workflows/airlock.yml
index 1f8a9f8..98f0810 100644
--- a/.github/workflows/airlock.yml
+++ b/.github/workflows/airlock.yml
@@ -117,7 +117,7 @@ jobs:
 
       # --- Phase 3: only a gated artifact reaches attestation and signing
       - name: GitHub-native build provenance (SLSA v1 predicate)
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dist/airlock-app.zip
       - name: Install cosign