diff --git a/.github/actions/install-tools/action.yaml b/.github/actions/install-tools/action.yaml
index 5ca3c2a0..9c100362 100644
--- a/.github/actions/install-tools/action.yaml
+++ b/.github/actions/install-tools/action.yaml
@@ -6,8 +6,11 @@ runs:
   steps:
     - uses: anchore/sbom-action/download-syft@b6a39da80722a2cb0ef5d197531764a89b5d48c3 # v0.15.8
 
-      # renovate: datasource=github-tags depName=anchore/grype versioning=semver
-    - run: "TAG=v0.74.6; curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin $TAG"
+    - name: install grype
+      env:
+        # renovate: datasource=github-tags depName=anchore/grype versioning=semver
+        VERSION: v0.74.6
+      run: "curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin $VERSION"
       shell: bash
 
     - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
diff --git a/renovate.json b/renovate.json
index 9028f6e2..0be86a4e 100644
--- a/renovate.json
+++ b/renovate.json
@@ -18,7 +18,7 @@
         ".github/actions/install-tools/action.yaml"
       ],
       "matchStrings": [
-        "# renovate: datasource=github-tags depName=anchore/grype versioning=semver\n.*TAG=(?<currentValue>v[\\d.]+)"
+        "# renovate: datasource=github-tags depName=anchore/grype versioning=semver\n\\s*VERSION: (?<currentValue>v[\\d.]+)"
       ],
       "datasourceTemplate": "github-tags",
       "depNameTemplate": "anchore/grype"