diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 1dc6649f6e..567a88799e 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -71,6 +71,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@49abf0ba24d0b7953cb586944e918a0b92074c80 # v2.22.4
+        uses: github/codeql-action/upload-sarif@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
         with:
           sarif_file: results.sarif
diff --git a/patterns/istio/README.md b/patterns/istio/README.md
index 6d69ad81be..c66441da6d 100644
--- a/patterns/istio/README.md
+++ b/patterns/istio/README.md
@@ -14,7 +14,11 @@ concepts.
 
 ## Deploy
 
-See [here](https://aws-ia.github.io/terraform-aws-eks-blueprints/getting-started/#prerequisites) for the prerequisites and steps to deploy this pattern.
+See [here](https://aws-ia.github.io/terraform-aws-eks-blueprints/getting-started/#prerequisites) for the prerequisites and run the following command to deploy this pattern.
+
+```sh
+terraform apply --auto-approve
+```
 
 Once the resources have been provisioned, you will need to replace the `istio-ingress` pods due to a [`istiod` dependency issue](https://github.com/istio/istio/issues/35789). Use the following command to perform a rolling restart of the `istio-ingress` pods:
 
diff --git a/patterns/istio/main.tf b/patterns/istio/main.tf
index 76a38c8ac9..254cc26c4f 100644
--- a/patterns/istio/main.tf
+++ b/patterns/istio/main.tf
@@ -165,9 +165,10 @@ module "eks_blueprints_addons" {
             }
             service = {
               annotations = {
-                "service.beta.kubernetes.io/aws-load-balancer-type"       = "nlb"
-                "service.beta.kubernetes.io/aws-load-balancer-scheme"     = "internet-facing"
-                "service.beta.kubernetes.io/aws-load-balancer-attributes" = "load_balancing.cross_zone.enabled=true"
+                "service.beta.kubernetes.io/aws-load-balancer-type"            = "external"
+                "service.beta.kubernetes.io/aws-load-balancer-nlb-target-type" = "ip"
+                "service.beta.kubernetes.io/aws-load-balancer-scheme"          = "internet-facing"
+                "service.beta.kubernetes.io/aws-load-balancer-attributes"      = "load_balancing.cross_zone.enabled=true"
               }
             }
           }