diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7bb3a5d1..a6ed3294 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -66,7 +66,7 @@ jobs:
         run: bash scripts/check-workspace-versions.sh
 
       - name: Cache Rust inputs
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: cargo-home-${{ runner.os }}-${{ runner.arch }}
           cache-targets: false
@@ -123,7 +123,7 @@ jobs:
         run: bash scripts/check-workspace-versions.sh
 
       - name: Cache Rust inputs
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: cargo-home-${{ runner.os }}-${{ runner.arch }}
           cache-targets: false
@@ -173,7 +173,7 @@ jobs:
           }
 
       - name: Cache Rust inputs
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: cargo-home-${{ runner.os }}-${{ runner.arch }}
           cache-targets: false
@@ -215,7 +215,7 @@ jobs:
         run: bash scripts/check-workspace-versions.sh
 
       - name: Cache Rust inputs
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: cargo-home-${{ runner.os }}-${{ runner.arch }}
           cache-targets: false
@@ -276,7 +276,7 @@ jobs:
         run: bash scripts/check-workspace-versions.sh
 
       - name: Install cargo-audit
-        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+        uses: taiki-e/install-action@cfdb7ed4ccc7c7dce37759eae89dc5674b469b39 # v2.90.3
         with:
           tool: cargo-audit@0.22.2
 
@@ -306,13 +306,13 @@ jobs:
         run: bash scripts/check-workspace-versions.sh
 
       - name: Cache Rust inputs
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: cargo-home-${{ runner.os }}-${{ runner.arch }}
           cache-targets: false
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+        uses: taiki-e/install-action@cfdb7ed4ccc7c7dce37759eae89dc5674b469b39 # v2.90.3
         with:
           tool: cargo-llvm-cov@0.8.7
 
diff --git a/.github/workflows/docs-site.yml b/.github/workflows/docs-site.yml
index 17b34ad8..13cf693c 100644
--- a/.github/workflows/docs-site.yml
+++ b/.github/workflows/docs-site.yml
@@ -57,7 +57,7 @@ jobs:
       # The site installs on its own (its package.json pins pnpm); pnpm before setup-node so the
       # pnpm cache resolves.
       - name: Install pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
         with:
           package_json_file: firlab/codegraph/package.json
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 42588141..da56481b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -303,7 +303,7 @@ jobs:
         run: bash scripts/check-workspace-versions.sh
 
       - name: Cache Rust artifacts
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: cargo-home-${{ runner.os }}-${{ runner.arch }}
           cache-targets: false
@@ -336,7 +336,7 @@ jobs:
         run: make check
 
       - name: Install cargo-audit
-        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+        uses: taiki-e/install-action@cfdb7ed4ccc7c7dce37759eae89dc5674b469b39 # v2.90.3
         with:
           tool: cargo-audit@0.22.2
 
@@ -418,7 +418,7 @@ jobs:
         run: bash scripts/check-workspace-versions.sh
 
       - name: Cache Rust artifacts
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           shared-key: cargo-home-${{ runner.os }}-${{ runner.arch }}
           key: ${{ matrix.target }}
@@ -438,7 +438,7 @@ jobs:
 
       - name: Install cargo-zigbuild
         if: matrix.use_zigbuild
-        uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+        uses: taiki-e/install-action@cfdb7ed4ccc7c7dce37759eae89dc5674b469b39 # v2.90.3
         with:
           tool: cargo-zigbuild@0.23.0