diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d9f6c6a..c1adca3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -83,7 +83,7 @@ jobs:
           sudo apt-get install -y apptainer
           apptainer --version
       - name: Setup JDK + Scala CLI
-        uses: VirtusLab/scala-cli-setup@v1
+        uses: VirtusLab/scala-cli-setup@v1.15.0
         with: { jvm: 'temurin:21' }
       - name: Build image
         run: |
@@ -164,7 +164,7 @@ jobs:
           if [ "${{ github.ref_type }}" = "tag" ]; then echo "tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT";
           else echo "tag=${{ inputs.version }}" >> "$GITHUB_OUTPUT"; fi
       - name: Setup JDK + Scala CLI
-        uses: VirtusLab/scala-cli-setup@v1
+        uses: VirtusLab/scala-cli-setup@v1.15.0
         with: { jvm: 'temurin:21' }
       # Rename the built sifs to immutable, content-addressed asset names and (re)generate the
       # lockfile mapping each image+arch to its sha256 + asset. Seeded from the prior lockfile on