diff --git a/.github/workflows/consumer-canary.yml b/.github/workflows/consumer-canary.yml
index c97461a..48e520a 100644
--- a/.github/workflows/consumer-canary.yml
+++ b/.github/workflows/consumer-canary.yml
@@ -13,12 +13,13 @@ name: consumer-canary
 #
 # Two jobs, one per resolution path:
 #
-#   prebuilt      pins the v0.3.6 release commit, like falcosecurity/libs.
+#   prebuilt      pins the active v0.4.0-rc.3 release commit, matching the
+#                 release candidate being exercised by downstream lanes.
 #                 A SHA that matches a release tag must resolve to prebuilt,
-#                 checksum-verified binaries. This release predates the
-#                 Action's attestation-enforcement change. The job deliberately
-#                 does NOT install libbpf-dev; if resolution regresses and it
-#                 falls back to a source build, the compile fails here.
+#                 checksum- and attestation-verified binaries. The job
+#                 deliberately does NOT install libbpf-dev; if resolution
+#                 regresses and it falls back to a source build, the compile
+#                 fails here.
 #
 #   source-build  pins @main, which is not a release, forcing the source
 #                 path with exactly the dependencies we document. If a
@@ -72,7 +73,7 @@ jobs:
           fi
 
       - name: Validate via the published action (pinned to a release commit)
-        uses: Kernel-Guard/bpfcompat@f1ba21fd4e098d483961e9e9355a51ae78273422 # v0.3.6
+        uses: Kernel-Guard/bpfcompat@cba1e09537f2e05e4ba7278efdb5c2d044d1889b # v0.4.0-rc.3
         with:
           # Command mode with no artifact and no shipped binary, so this job
           # needs no compiler at all: the example .bpf.o objects are built,