diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index c4ff1e5..4c80d88 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -207,7 +207,7 @@ jobs:
       packages: read
     # zircote/.github main @ 77a87549 (merged 2026-06-16)
     uses: >-
-      zircote/.github/.github/workflows/reusable-trivy.yml@77a87549a65c6c978a0e87efe0168ed3517f7ca4
+      zircote/.github/.github/workflows/reusable-trivy.yml@aa00b2f09e8e42bd88cd002b441fcd6c46ecaff8
     with:
       image-ref: >-
         ghcr.io/${{ github.repository }}@${{
diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml
index 638df1f..d9a9282 100644
--- a/.github/workflows/quality-gates.yml
+++ b/.github/workflows/quality-gates.yml
@@ -90,6 +90,6 @@ jobs:
       packages: read
     # zircote/.github main @ 77a87549 (resolved 2026-06-16)
     uses: >-
-      zircote/.github/.github/workflows/reusable-trivy.yml@77a87549a65c6c978a0e87efe0168ed3517f7ca4
+      zircote/.github/.github/workflows/reusable-trivy.yml@aa00b2f09e8e42bd88cd002b441fcd6c46ecaff8
     with:
       scan-iac: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 57674ba..b9ce9f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -347,7 +347,7 @@ jobs:
       packages: read   # reusable's (skipped) image job declares it
     # zircote/.github main @ 77a87549 (merged 2026-06-16)
     uses: >-
-      zircote/.github/.github/workflows/reusable-trivy.yml@77a87549a65c6c978a0e87efe0168ed3517f7ca4
+      zircote/.github/.github/workflows/reusable-trivy.yml@aa00b2f09e8e42bd88cd002b441fcd6c46ecaff8
     with:
       scan-iac: true