diff --git a/.github/workflows/issue-bot.yml b/.github/workflows/issue-bot.yml
index a91aa1f..ad26d5c 100644
--- a/.github/workflows/issue-bot.yml
+++ b/.github/workflows/issue-bot.yml
@@ -1,5 +1,5 @@
 name: Shadow   # load-bearing: auto-approve.yml keys on this exact name
-# To upgrade the engine, bump the SHA in BOTH `uses:` and `shadow_ref` below
+# To upgrade the engine, bump the ref in BOTH `uses:` and `shadow_ref` below
 # (GitHub forbids expressions in `uses:`, so they can't share a variable).
 
 on:
@@ -40,11 +40,11 @@ jobs:
       (github.event_name == 'workflow_dispatch') ||
       (github.actor != 'github-actions[bot]' &&
        (github.event.issue.pull_request == null || github.event_name == 'pull_request_target'))
-    uses: sudsali/shadow/.github/workflows/shadow-review.yml@54ec94e0ca8c90d9b58ff95a2a06b175a115784e
+    uses: sudsali/shadow/.github/workflows/shadow-review.yml@ed31ed7e30ef81be82d7b8b756b626f876036d73 # v1.7
     with:
       pr_number: ${{ inputs.issue_number }}
       dry_run: ${{ inputs.dry_run && 'true' || 'false' }}
-      shadow_ref: 54ec94e0ca8c90d9b58ff95a2a06b175a115784e
+      shadow_ref: ed31ed7e30ef81be82d7b8b756b626f876036d73 # v1.7
       aws_region: us-east-1
       prompt_sm_prefix: pydeequ-bot
     secrets: