diff --git a/Makefile b/Makefile
index cff6046e..8deb7e99 100644
--- a/Makefile
+++ b/Makefile
@@ -52,7 +52,7 @@ $(LOCALBIN):
 
 ## Tool Binaries
 GOLANGCI_LINT = $(LOCALBIN)/golangci-lint-$(GOLANGCI_LINT_VERSION)
-GOVULNCHECK ?= $(LOCALBIN)/govulncheck
+GOVULNCHECK = $(LOCALBIN)/govulncheck-$(GOVULNCHECK_VERSION)
 
 # Pinned version of golangci-lint; bump here to upgrade the linter across CI and local runs.
 GOLANGCI_LINT_VERSION ?= v2.11.4
@@ -61,10 +61,12 @@ golangci-lint: $(GOLANGCI_LINT) ## Download golangci-lint locally if necessary.
 $(GOLANGCI_LINT): $(LOCALBIN)
 	$(call go-install-tool,$(GOLANGCI_LINT),github.com/golangci/golangci-lint/v2/cmd/golangci-lint,$(GOLANGCI_LINT_VERSION))
 
+# Pinned version of govulncheck; bump here to upgrade the scanner across CI and local runs.
+GOVULNCHECK_VERSION ?= v1.1.4
 .PHONY: govulncheck
 govulncheck: $(GOVULNCHECK) ## Install govulncheck locally if necessary.
 $(GOVULNCHECK): $(LOCALBIN)
-	$(call go-install-tool,$(GOVULNCHECK),golang.org/x/vuln/cmd/govulncheck,latest)
+	$(call go-install-tool,$(GOVULNCHECK),golang.org/x/vuln/cmd/govulncheck,$(GOVULNCHECK_VERSION))
 
 # go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
 # $1 - target path with name of binary (ideally with version)