diff --git a/.github/workflows/scancode.yml b/.github/workflows/scancode.yml
index 4c84ac0..de512aa 100644
--- a/.github/workflows/scancode.yml
+++ b/.github/workflows/scancode.yml
@@ -32,7 +32,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-pip-scancode-
 
-      - uses: aboutcode-org/scancode-action@e46d127dfbe502ad2699fbbba8efedad1b2adbd1 # beta
+      - uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9 # main, 2026-07-10
         with:
           pipelines: "scan_codebase"
           output-formats: "json spdx cyclonedx"
diff --git a/policies.yml b/policies.yml
index da680e6..f6d7ea7 100644
--- a/policies.yml
+++ b/policies.yml
@@ -40,3 +40,6 @@ license_policies:
   - license_key: lgpl-3.0
     label: Prohibited License
     compliance_alert: error
+  - license_key: agpl-3.0-or-later
+    label: Prohibited License
+    compliance_alert: error