diff --git a/.github/workflows/android-source-beta-acceptance.yml b/.github/workflows/android-source-beta-acceptance.yml
index 0f888ec..8835046 100644
--- a/.github/workflows/android-source-beta-acceptance.yml
+++ b/.github/workflows/android-source-beta-acceptance.yml
@@ -66,7 +66,7 @@ jobs:
         run: test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
       - name: Set up Java
         if: steps.gate.outputs.run == 'true'
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: "21"
@@ -102,7 +102,7 @@ jobs:
           targets: aarch64-linux-android
       - name: Restore Rust cache
         if: steps.gate.outputs.run == 'true'
-        uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+        uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           cache-bin: "false"
       - name: Build release CLI
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f99d255..f3b07ae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install --yes --no-install-recommends libfontconfig1-dev
-      - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           cache-bin: "false"
       - name: License policy
@@ -144,7 +144,7 @@ jobs:
           if failures:
               raise SystemExit("Broken local Markdown links:\n" + "\n".join(failures))
           PY
-      - uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2
+      - uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8 # v2
         with:
           tool: mdbook@0.5.4
           fallback: none
@@ -183,7 +183,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install --yes --no-install-recommends libfontconfig1-dev
-      - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           cache-bin: "false"
       - name: Workspace tests (Linux)
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index c5283a4..74fb97e 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
-      - uses: taiki-e/install-action@7f4eb899022d8fe70b20c4f3de697aa85c309026 # v2
+      - uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8 # v2
         with:
           tool: mdbook@0.5.4
           fallback: none
@@ -43,4 +43,4 @@ jobs:
     steps:
       - name: Deploy
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5
diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml
index a867e55..44f7d31 100644
--- a/.github/workflows/draft-release.yml
+++ b/.github/workflows/draft-release.yml
@@ -44,7 +44,7 @@ jobs:
           node-version: "20"
           cache: npm
           cache-dependency-path: editors/vscode/package-lock.json
-      - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           cache-bin: "false"
       - name: Install Linux prerequisites
diff --git a/.github/workflows/platform-artifacts.yml b/.github/workflows/platform-artifacts.yml
index 7b6593a..f58a394 100644
--- a/.github/workflows/platform-artifacts.yml
+++ b/.github/workflows/platform-artifacts.yml
@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: "21"
@@ -56,7 +56,7 @@ jobs:
         with:
           toolchain: stable
           targets: aarch64-linux-android
-      - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           cache-bin: "false"
       - name: Generate default starter with the public CLI
@@ -272,7 +272,7 @@ jobs:
         with:
           toolchain: stable
           targets: aarch64-apple-ios-sim
-      - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         with:
           cache-bin: "false"
       - name: Inspect Xcode prerequisites
diff --git a/.github/workflows/vscode-extension.yml b/.github/workflows/vscode-extension.yml
index 3756651..0eed995 100644
--- a/.github/workflows/vscode-extension.yml
+++ b/.github/workflows/vscode-extension.yml
@@ -48,7 +48,7 @@ jobs:
         if: runner.os == 'Linux'
         with:
           toolchain: stable
-      - uses: Swatinem/rust-cache@258712b0b7b1ddf8bddc9fc3b0faca682b2736c3 # v2
+      - uses: Swatinem/rust-cache@f0d9c3887740aee45f6153b24b3a6b815192ec16 # v2
         if: runner.os == 'Linux'
         with:
           cache-bin: "false"