diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 45720440..568a0a5e 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -30,7 +30,7 @@ jobs:
       # not in rust-toolchain.toml, so a clone does not install them
       - name: Install the llvm tools
         run: rustup component add llvm-tools-preview
-      - uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
+      - uses: taiki-e/install-action@cfdb7ed4ccc7c7dce37759eae89dc5674b469b39 # v2.90.3
         with:
           # pinned for the reason the actions are
           tool: cargo-llvm-cov@0.9.0
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 8b9361fb..51258e96 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -74,7 +74,7 @@ jobs:
 
       - name: Log in to the container registry
         if: inputs.release
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index 32497661..e6a5e0cf 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -48,7 +48,7 @@ jobs:
           # made the cargo-release install below a no-op with no binary there
           cache-bin: false
 
-      - uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
+      - uses: taiki-e/install-action@cfdb7ed4ccc7c7dce37759eae89dc5674b469b39 # v2.90.3
         with:
           # pinned exactly, since a tool that floats makes a release
           # unreproducible: these write the release commit and the changelog,
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 97597083..2f9ba57a 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -38,7 +38,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # fetches a prebuilt cargo-deny rather than compiling one
-      - uses: taiki-e/install-action@b80e2bb2635f28eb98b9fce1e2f0887e1535c6b2 # v2.90.0
+      - uses: taiki-e/install-action@cfdb7ed4ccc7c7dce37759eae89dc5674b469b39 # v2.90.3
         with:
           # Pinned because deny.toml's fields are the ones this version
           # defines. The advisory database is still fetched at run time, which