diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
index 2b2a099..136a763 100644
--- a/.github/workflows/cd.yaml
+++ b/.github/workflows/cd.yaml
@@ -281,4 +281,4 @@ jobs:
         # Jobs) that previously only the system-test path emitted. kubectl uses
         # the Talos cert-based admin@prod kubeconfig, so no HCLOUD_TOKEN is
         # needed by the diagnostics themselves.
-        uses: devantler-tech/.github/actions/diagnose-flux@3f0791b9b2f435133d13980e918ac8f2f361c519 # v20.1.4
+        uses: devantler-tech/.github/actions/diagnose-flux@933b53600c15fe7a67189756307cb19e23090c99 # v21.0.1
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index aaef87c..2a37ba6 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -220,7 +220,7 @@ jobs:
         # Shared composite — single source of truth for Flux failure diagnostics
         # (devantler-tech/actions#367). Default kustomizations match this job's
         # previous inline list (infrastructure-controllers infrastructure apps).
-        uses: devantler-tech/.github/actions/diagnose-flux@3f0791b9b2f435133d13980e918ac8f2f361c519 # v20.1.4
+        uses: devantler-tech/.github/actions/diagnose-flux@933b53600c15fe7a67189756307cb19e23090c99 # v21.0.1
 
       - name: 🔥 Delete cluster
         if: always()
@@ -421,7 +421,7 @@ jobs:
         # Jobs) that previously only the system-test path emitted. kubectl uses
         # the Talos cert-based admin@prod kubeconfig, so no HCLOUD_TOKEN is
         # needed by the diagnostics themselves.
-        uses: devantler-tech/.github/actions/diagnose-flux@3f0791b9b2f435133d13980e918ac8f2f361c519 # v20.1.4
+        uses: devantler-tech/.github/actions/diagnose-flux@933b53600c15fe7a67189756307cb19e23090c99 # v21.0.1
 
   ci-required-checks:
     name: CI - Required Checks