diff --git a/src/gitlab/install-sfw.ts b/src/gitlab/install-sfw.ts
index 293a034..fa89a7d 100644
--- a/src/gitlab/install-sfw.ts
+++ b/src/gitlab/install-sfw.ts
@@ -8,7 +8,7 @@ import path from "node:path";
 import { commandPath, exportShellEnv } from "./shell.js";
 import type { InstallCommand, RunInstallEntry } from "./types.js";
 
-const SFW_VERSION = "v1.12.0";
+const SFW_VERSION = "v1.13.1";
 const SFW_RELEASE_BASE = `https://github.com/SocketDev/sfw-free/releases/download/${SFW_VERSION}`;
 const DOWNLOAD_TIMEOUT_MS = 60_000;
 type DownloadClient = typeof httpGet;
diff --git a/src/install-sfw.ts b/src/install-sfw.ts
index 3e50d2a..c24aa1b 100644
--- a/src/install-sfw.ts
+++ b/src/install-sfw.ts
@@ -14,7 +14,7 @@ import type { Inputs } from "./types.js";
 // reproducibility. For stricter supply-chain hygiene, users can compose
 // `socketdev/action@<sha>` ahead of this action — see README "Advanced:
 // stricter supply chain via socketdev/action".
-const SFW_VERSION = "v1.12.0";
+const SFW_VERSION = "v1.13.1";
 const SFW_RELEASE_BASE = `https://github.com/SocketDev/sfw-free/releases/download/${SFW_VERSION}`;
 const INSTALL_MAX_ROUNDS = 2;
 const INSTALL_RETRY_DELAY_MS = 2000;