diff --git a/.github/workflows/depsound.yml b/.github/workflows/depsound.yml
index 1e3565e..b7c2879 100644
--- a/.github/workflows/depsound.yml
+++ b/.github/workflows/depsound.yml
@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: read # diff the PR's manifests; this job never sees a write token
     steps:
-      - uses: rvagg/depsound-action@7c7eb2bfc936dc8242f0592f6d7c4f9835510380 # v0.3.6
+      - uses: rvagg/depsound-action@49940d1f04828a01799cc129f3930d9bd42bceda # v0.5.0
   post:
     needs: review
     if: ${{ always() && needs.review.result != 'cancelled' }} # a failed review still posts its failure marker
@@ -30,4 +30,4 @@ jobs:
       checks: write        # set the neutral check
       actions: read        # download the report artifact
     steps:
-      - uses: rvagg/depsound-action/post@7c7eb2bfc936dc8242f0592f6d7c4f9835510380 # v0.3.6
+      - uses: rvagg/depsound-action/post@49940d1f04828a01799cc129f3930d9bd42bceda # v0.5.0