diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a7fc486..aa4d309 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -53,7 +53,7 @@ jobs:
       # rustc-version-aware key, and target/ cleanup before save (avoids bloat).
       # Survives Cargo.toml dev-dep changes via partial restore, unlike the
       # previous hashFiles(**/Cargo.toml) key.
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           cache-on-failure: true
           # Cache the workspace across all steps in this job; key already
@@ -63,7 +63,7 @@ jobs:
       # Prebuilt binaries via taiki-e/install-action — seconds vs. minutes
       # compared to `cargo install --locked` building from source.
       - name: Install cargo-llvm-cov + cargo-nextest
-        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+        uses: taiki-e/install-action@5488ac5a951645ce95062214902ac4b6bc1a1037 # v2.87.32
         with:
           tool: cargo-llvm-cov,cargo-nextest
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 574f98a..50aa3f1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,10 +49,10 @@ jobs:
       - name: Install typeDiagram
         run: npm install -g typediagram@0.11.0
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
       - name: Install release tooling (coverage, test runner, version stamper, vuln gate)
-        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+        uses: taiki-e/install-action@5488ac5a951645ce95062214902ac4b6bc1a1037 # v2.87.32
         with:
           tool: cargo-llvm-cov,cargo-nextest,shipwright-version-stamp,cargo-deny
 
@@ -106,7 +106,7 @@ jobs:
 
       - name: Authenticate to crates.io via OIDC
         id: auth
-        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
 
       # Publish leaf crates (no internal deps) first, then dependents. `cargo
       # publish` waits for index propagation before returning, so each dependent