diff --git a/updatecli-compose.yaml b/updatecli-compose.yaml
index a04c88d..51ce54f 100644
--- a/updatecli-compose.yaml
+++ b/updatecli-compose.yaml
@@ -33,6 +33,6 @@ policies:
       - updatecli/values.d/updatecli_gha.yaml
 
   - name: Install Zizmor everywhere
-    policy: ghcr.io/updatecli/policies/zizmor/githubaction/scaffold:0.4.0
+    policy: ghcr.io/updatecli/policies/zizmor/githubaction/scaffold:0.5.0@sha256:1acbf6167a1df5522e0a4ba4aa7e1aa2dc404e4e8035a565d6a0157fadb93380
     values:
       - updatecli/values.d/scm_githubsearch.yaml