diff --git a/.github/workflows/assign-id.yml b/.github/workflows/assign-id.yml
index 8283076a..baa6b786 100644
--- a/.github/workflows/assign-id.yml
+++ b/.github/workflows/assign-id.yml
@@ -46,7 +46,7 @@ jobs:
       - name: Fetch base
         run: git fetch origin dev:refs/remotes/origin/dev --no-tags --depth=200
 
-      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1.17.0
+      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
           toolchain: stable
           components: ''
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba03aa61..789a4e1d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -301,7 +301,7 @@ jobs:
         uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@5bf6ce016fd2e72eefc647cbca1e4213f65955b8  # v2.87.5
+        uses: taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af  # v2.87.11
         with:
           tool: cargo-nextest
 
@@ -353,7 +353,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install sccache
-        uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696  # v0.0.10
+        uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
 
       - name: Probe sccache backend
         # Same probe pattern as the check/test jobs — see comment there.
@@ -379,7 +379,7 @@ jobs:
           fi
 
       - name: Rust cache
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
         with:
           key: embedding-oracle
 
@@ -392,13 +392,13 @@ jobs:
         # `FORGEPLAN_REQUIRE_MODEL_IN_TESTS` guard is for — if the cached
         # weights were ever wrong, the oracle's vector comparison would be
         # the thing that catches it, not the cache key.
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v6.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ~/.cache/forgeplan/models
           key: embedding-model-bge-m3
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@3d7d7cd5ac7f994c1892ae0c06165095b9139094  # v2.85.1
+        uses: taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af  # v2.87.11
         with:
           tool: cargo-nextest