diff --git a/.github/workflows/validations.yaml b/.github/workflows/validations.yaml
index 998ba78ef..d576ae792 100644
--- a/.github/workflows/validations.yaml
+++ b/.github/workflows/validations.yaml
@@ -99,7 +99,7 @@ jobs:
       # go-make's setup only (not ./.github/actions/bootstrap): binny ships no windows release, so binny tools
       # are unavailable here (`make unit` skips the fixture refresh on windows)
       - name: Setup go + go-make tooling
-        uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1
+        uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1
         with:
           # keep in sync with the go-version default in ./.github/actions/bootstrap
           go-version: "1.26.2"
@@ -195,7 +195,7 @@ jobs:
 
       # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary
       - name: Setup go + go-make tooling
-        uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1
+        uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1
         with:
           # keep in sync with the go-version default in ./.github/actions/bootstrap
           go-version: "1.26.2"
@@ -228,7 +228,7 @@ jobs:
 
       # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary
       - name: Setup go + go-make tooling
-        uses: anchore/go-make/.github/actions/setup@fa5421b3bf24c9d18f11a736c5eb4172f2b7d683 # v0.8.1
+        uses: anchore/go-make/.github/actions/setup@27a9f35f41b5fe86d68815844efd2ba816e9ba6b # v0.9.1
         with:
           # keep in sync with the go-version default in ./.github/actions/bootstrap
           go-version: "1.26.2"