diff --git a/.github/workflows/minimal-crates.yaml b/.github/workflows/minimal-crates.yaml
index ef071f3..0bd625f 100644
--- a/.github/workflows/minimal-crates.yaml
+++ b/.github/workflows/minimal-crates.yaml
@@ -63,7 +63,7 @@ jobs:
       - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
         continue-on-error: true
       - uses: $/.github/workflows/sccache-probe
-      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: nightly
       - name: Install Go (required for aws-lc-rs FIPS)
@@ -125,7 +125,7 @@ jobs:
         continue-on-error: true
       - uses: $/.github/workflows/sccache-probe
 
-      - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
+      - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2.33.0
         with:
           # Blacksmith's Windows image ships no pre-installed MSYS2 (C:\msys64).
           release: true
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 4e8614d..e77b906 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
+      - uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30
         with:
           tool: zizmor
       # whole repo, not just workflows/ -- dependabot.yml is audited too