diff --git a/.github/workflows/gerrit-clm.yaml b/.github/workflows/gerrit-clm.yaml
index 93bb538694..abd994aad4 100644
--- a/.github/workflows/gerrit-clm.yaml
+++ b/.github/workflows/gerrit-clm.yaml
@@ -137,7 +137,7 @@ jobs:
     permissions:
       contents: read
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml@7483557cf53b18109e679b8a3da42ce8e6dff219  # v0.8.0
+    uses: lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml@ae96a8d9cd91d99a70be0d301c91b539aea617e3  # v0.9.1
     with:
       # Build before scanning: Nexus IQ identifies far more components
       # from the packaged output than from source alone. Tests and Jib