diff --git a/.github/workflows/iac-tests.yml b/.github/workflows/iac-tests.yml
index 14b5a454..862b7864 100644
--- a/.github/workflows/iac-tests.yml
+++ b/.github/workflows/iac-tests.yml
@@ -219,7 +219,7 @@ jobs:
       # AWS STS exchanges for credentials via an IAM role's trust
       # policy. No long-lived secrets in the repo.
       - name: Assume AWS role via OIDC
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b  # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d  # v6.2.2
         with:
           role-to-assume: ${{ vars.AWS_OIDC_ROLE_ARN }}
           aws-region: eu-west-1
diff --git a/.github/workflows/integration-live.yml b/.github/workflows/integration-live.yml
index 4a84919a..b6240cb7 100644
--- a/.github/workflows/integration-live.yml
+++ b/.github/workflows/integration-live.yml
@@ -104,7 +104,7 @@ jobs:
       # ── AWS — OIDC role assumption, no static keys ──────────────────
       - name: Configure AWS credentials via OIDC
         if: steps.gate.outputs.aws == 'true'
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b  # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d  # v6.2.2
         with:
           role-to-assume: ${{ secrets.AWS_INTEGRATION_ROLE }}
           role-session-name: forge-live-${{ github.run_id }}
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 0951c89b..06d9c6e5 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -258,7 +258,7 @@ jobs:
       # repo+ref combination. Returns short-lived temporary credentials.
       - name: Configure AWS credentials via OIDC
         if: steps.gate.outputs.enabled == 'true'
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b  # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d  # v6.2.2
         with:
           role-to-assume: ${{ secrets.AWS_INTEGRATION_ROLE }}
           role-session-name: forge-ci-${{ github.run_id }}