diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 9feecd82..3dc0708b 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -32,6 +32,12 @@ jobs:
           ref: ${{ steps.vars.outputs.TAG_NAME }}
           submodules: recursive
 
+      - name: Use current vulnerability policy from default branch
+        if: inputs.tag != ''
+        run: |
+          git fetch --depth=1 origin ${{ github.event.repository.default_branch }}
+          git checkout FETCH_HEAD -- .trivyignore.yaml || echo "Keeping tagged .trivyignore.yaml"
+
       - name: Create SBOM with Trivy
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         env:
diff --git a/Cargo.lock b/Cargo.lock
index bc8d66b1..5a60a402 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -866,7 +866,7 @@ dependencies = [
 [[package]]
 name = "defguard_certs"
 version = "0.0.0"
-source = "git+https://github.com/DefGuard/defguard.git?rev=cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5#cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5"
+source = "git+https://github.com/DefGuard/defguard.git?rev=a1b67061bb4670324e4559a1a2a18990932e9af2#a1b67061bb4670324e4559a1a2a18990932e9af2"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -880,7 +880,7 @@ dependencies = [
 [[package]]
 name = "defguard_common"
 version = "2.1.0"
-source = "git+https://github.com/DefGuard/defguard.git?rev=cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5#cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5"
+source = "git+https://github.com/DefGuard/defguard.git?rev=a1b67061bb4670324e4559a1a2a18990932e9af2#a1b67061bb4670324e4559a1a2a18990932e9af2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -922,7 +922,7 @@ dependencies = [
 [[package]]
 name = "defguard_grpc_tls"
 version = "0.0.0"
-source = "git+https://github.com/DefGuard/defguard.git?rev=cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5#cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5"
+source = "git+https://github.com/DefGuard/defguard.git?rev=a1b67061bb4670324e4559a1a2a18990932e9af2#a1b67061bb4670324e4559a1a2a18990932e9af2"
 dependencies = [
  "defguard_common",
  "http",
@@ -939,7 +939,7 @@ dependencies = [
 [[package]]
 name = "defguard_version"
 version = "0.0.0"
-source = "git+https://github.com/DefGuard/defguard.git?rev=cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5#cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5"
+source = "git+https://github.com/DefGuard/defguard.git?rev=a1b67061bb4670324e4559a1a2a18990932e9af2#a1b67061bb4670324e4559a1a2a18990932e9af2"
 dependencies = [
  "axum",
  "http",
@@ -1222,7 +1222,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2276,7 +2276,7 @@ dependencies = [
 [[package]]
 name = "model_derive"
 version = "0.0.0"
-source = "git+https://github.com/DefGuard/defguard.git?rev=cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5#cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5"
+source = "git+https://github.com/DefGuard/defguard.git?rev=a1b67061bb4670324e4559a1a2a18990932e9af2#a1b67061bb4670324e4559a1a2a18990932e9af2"
 dependencies = [
  "quote",
  "syn 2.0.119",
@@ -2421,7 +2421,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -3423,7 +3423,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4172,7 +4172,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 3d9b7a1b..65f39e52 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,9 +9,9 @@ axum = "0.8"
 base64 = "0.23"
 chrono = "0.4"
 clap = { version = "4.6", features = ["derive", "env"] }
-defguard_certs = { git = "https://github.com/DefGuard/defguard.git", rev = "cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5" }
-defguard_grpc_tls = { git = "https://github.com/DefGuard/defguard.git", rev = "cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5" }
-defguard_version = { git = "https://github.com/DefGuard/defguard.git", rev = "cdf3ef9a70796d47a6247ad1300d2e6bb7474cf5" }
+defguard_certs = { git = "https://github.com/DefGuard/defguard.git", rev = "a1b67061bb4670324e4559a1a2a18990932e9af2" }
+defguard_grpc_tls = { git = "https://github.com/DefGuard/defguard.git", rev = "a1b67061bb4670324e4559a1a2a18990932e9af2" }
+defguard_version = { git = "https://github.com/DefGuard/defguard.git", rev = "a1b67061bb4670324e4559a1a2a18990932e9af2" }
 defguard_wireguard_rs = "0.11"
 rustls = { version = "0.23", default-features = false, features = ["ring"] }
 rustls-pki-types = "1"