diff --git a/.github/actions/setup-env/action.yml b/.github/actions/setup-env/action.yml
index f4d8f7f3..8311cecd 100644
--- a/.github/actions/setup-env/action.yml
+++ b/.github/actions/setup-env/action.yml
@@ -37,7 +37,7 @@ runs:
       # `github-actions` ecosystem with `directory: "/"` scans only
       # .github/workflows plus a ROOT-level action.yml, never .github/actions/**
       # (dependabot-core#6345). .github/dependabot.yml now covers this directory.
-      uses: mamba-org/setup-micromamba@ce51e99f4bb8a82ab7158c4dc59ef4634c59c4f9 # v3.1.0
+      uses: mamba-org/setup-micromamba@f457c30a868e4760d3a6fcea5f25dc655b8edf39 # v3.2.1
       with:
         # Pin the micromamba BINARY, not just the action SHA (pin-and-hold, PRD §4.1).
         # Unset, this input defaults to `latest`, which leaves the tool that RESTORES