diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 88442af5..3f8d3088 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -347,7 +347,7 @@ jobs:
       - name: Docker Scout scan the release image
         id: scout
         if: ${{ !cancelled() }}
-        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
+        uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           image: local://permitio/pdp-v2:release-scan
diff --git a/.github/workflows/scheduled-security-scan.yml b/.github/workflows/scheduled-security-scan.yml
index 4b381da9..e89d831b 100644
--- a/.github/workflows/scheduled-security-scan.yml
+++ b/.github/workflows/scheduled-security-scan.yml
@@ -269,7 +269,7 @@ jobs:
         # `if:` is skipped once anything earlier in the job has failed, and a skipped report
         # leaves code scanning showing yesterday's answer for this image.
         if: ${{ !cancelled() }}
-        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
+        uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           # `registry://`, NOT the `local://` that tests.yml uses. There is no local image
@@ -292,7 +292,7 @@ jobs:
         # Load-bearing, not defensive. Without it a failed report step skips this one, and
         # the report job would have nothing from Scout to read.
         if: ${{ !cancelled() }}
-        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
+        uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           image: registry://permitio/pdp-v2:latest
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 8c1326ec..efc10c3d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -447,7 +447,7 @@ jobs:
           username: ${{ vars.DOCKERHUB_ORGANIZATION }}
 
       - name: Docker Scout CVE report (all severities)
-        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
+        uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           image: local://permitio/pdp-v2:next
@@ -473,7 +473,7 @@ jobs:
 
       - name: Docker Scout CVE gate (high and critical)
         id: scout-gate
-        uses: docker/scout-action@7c6b6c3f7844478ace1ffd4e7aef649053d1f87d # v1.24.0
+        uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
         with:
           command: cves
           image: local://permitio/pdp-v2:next