diff --git a/.github/workflows/buf-ci.yaml b/.github/workflows/buf-ci.yaml
index f4d08fb..a2c323d 100644
--- a/.github/workflows/buf-ci.yaml
+++ b/.github/workflows/buf-ci.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.2.0
-      - uses: bufbuild/buf-action@8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3 # v1.5.0
+      - uses: bufbuild/buf-action@85aebf73123b5c15fd5528aaecbf9129cddf7fa7 # v1.6.0
         # Dependabot runs read the Dependabot secret store, so secrets.BUF_TOKEN is
         # empty there and the BSR push fails. Nothing in a dependabot PR touches the
         # protos, so skip the whole step.