diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index eea6f0f2..42b1eb8a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -203,7 +203,7 @@ jobs:
     # -------------------------
     - name: Run Trivy security scanner
       if: ${{ !inputs.skip_code_scans }}
-      uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
+      uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
       with:
         scan-type: 'fs'
         scan-ref: '.'
diff --git a/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java b/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java
index 733470c8..ababfb1c 100644
--- a/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java
+++ b/src/test/java/dev/metaschema/oscal/lib/validation/OscalValidationTest.java
@@ -80,7 +80,7 @@ void testValidateOscalProfileXml()
 
     IValidationResult validationResult = bindingContext.validate(
         new URI(
-            "https://raw.githubusercontent.com/GSA/fedramp-automation/refs/heads/develop/src/validations/constraints/content/fedramp-tailoring-profile.xml"),
+            "https://raw.githubusercontent.com/OSCAL-Foundation/fedramp-automation/c784140bc6d1ac9fa159aabc0e8a29e9aa2c63a9/src/content/rev5/baselines/xml/FedRAMP_rev5_MODERATE-baseline_profile.xml"),
         Format.XML,
         new ValidationProvider(module),
         null);