diff --git a/pkl/builtins/pinact.pkl b/pkl/builtins/pinact.pkl
index f8003eddd..c8ca5212b 100644
--- a/pkl/builtins/pinact.pkl
+++ b/pkl/builtins/pinact.pkl
@@ -7,7 +7,7 @@ import "./test/helpers.pkl"
   description = "Pin GitHub Actions to commit SHA for security"
 }
 const pinact = new Config.Step {
-  glob = List(".github/workflows/*", "*/action.*")
+  glob = List(".github/workflows/*", "**/action.*")
   types = List("yaml")
   // `verify-comment` verifies pairs of commit SHA and version comments are correct
   check_diff = new Config.CommandSpec {
diff --git a/pkl/builtins/pinact_update.pkl b/pkl/builtins/pinact_update.pkl
index b0cd33fe4..7d6ff5d0f 100644
--- a/pkl/builtins/pinact_update.pkl
+++ b/pkl/builtins/pinact_update.pkl
@@ -6,7 +6,7 @@ import "../Config.pkl"
   description = "Pin GitHub Actions to update actions to latest versions"
 }
 const pinact_update = new Config.Step {
-  glob = List(".github/workflows/*", "*/action.*")
+  glob = List(".github/workflows/*", "**/action.*")
   types = List("yaml")
   // `verify-comment` verifies pairs of commit SHA and version comments are correct
   check_diff = new Config.CommandSpec {