diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml
index b989cb8..acee3b9 100644
--- a/.github/actions/setup-rust/action.yml
+++ b/.github/actions/setup-rust/action.yml
@@ -18,7 +18,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master @ 2026-07-16
+    - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master @ 2026-07-16
       with:
         toolchain: ${{ inputs.toolchain }}
         components: rustfmt, clippy
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dab20b3..ad8e3c0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -157,7 +157,7 @@ jobs:
       # package-manager-cache is off deliberately: this repository has no
       # lockfile to key a cache on, and the control plane has no dependencies.
       - name: Install pinned Node
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24.19.0"
           package-manager-cache: false
@@ -202,7 +202,7 @@ jobs:
       - name: Install pinned Rust toolchain
         uses: ./kafka-benchmarks/.github/actions/setup-rust
       - name: Install pinned Node
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24.19.0"
           package-manager-cache: false
@@ -223,7 +223,7 @@ jobs:
       # the script but not this line fails the workspace lane instead of
       # silently serving a build of the previous source.
       - name: Restore the reviewed librdkafka build
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             kafka-benchmarks/target/benchmarks/downloads
@@ -297,7 +297,7 @@ jobs:
       - name: Install pinned Rust toolchain
         uses: ./kafka-benchmarks/.github/actions/setup-rust
       - name: Install pinned Node
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24.19.0"
           package-manager-cache: false
@@ -311,7 +311,7 @@ jobs:
       # bytes of the reviewed source checksum fully determine the cached bytes,
       # so there are deliberately no restore-keys.
       - name: Restore the reviewed librdkafka build
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             kafka-benchmarks/target/benchmarks/downloads
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 8e4dc51..fb324c7 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -96,7 +96,7 @@ jobs:
       - name: Install pinned Rust toolchain
         uses: ./kafka-benchmarks/.github/actions/setup-rust
       - name: Install pinned Node
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24.19.0"
           package-manager-cache: false
@@ -113,7 +113,7 @@ jobs:
       # restore-keys, because a partial match would mean measuring a build of
       # unreviewed source and reporting it under the reviewed version.
       - name: Restore the reviewed librdkafka build
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             kafka-benchmarks/target/benchmarks/downloads