diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 88076bcf0..1d3ee492d 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -53,7 +53,7 @@ jobs:
       - if: runner.environment == 'github-hosted'
         uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # main
       - if: runner.environment == 'github-hosted'
-        uses: DeterminateSystems/flake-checker-action@9ee1c5473f1abdfb299f6c4f0fab813147c97fe3 # main
+        uses: DeterminateSystems/flake-checker-action@a0f068d37b542f3150564fbf1164fec2d958ee11 # main
 
       # GitHub-hosted fallback caches Rust via the Actions cache. The self-hosted
       # box runs the heavy Rust CI (clippy/doc/test) as plain cargo, reusing a
diff --git a/.github/workflows/release-kt.yml b/.github/workflows/release-kt.yml
index de799b709..19e459e97 100644
--- a/.github/workflows/release-kt.yml
+++ b/.github/workflows/release-kt.yml
@@ -151,7 +151,7 @@ jobs:
       - name: Set up Android SDK
         uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
 
-      - uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+      - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
 
       - name: Download per-target libs
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
diff --git a/.github/workflows/update-flake.yml b/.github/workflows/update-flake.yml
index 2a7099acb..cd96544c1 100644
--- a/.github/workflows/update-flake.yml
+++ b/.github/workflows/update-flake.yml
@@ -29,7 +29,7 @@ jobs:
         run: dirname "$(command -v nix)" >> "$GITHUB_PATH"
 
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@b83e0671a67dfd774680fb1beaa1497ef7e58bfc # main
+        uses: DeterminateSystems/update-flake-lock@fd9359ac79d0e912f1b4b947a48470b3e2799b56 # main
         with:
           pr-title: "Update flake.lock"
           pr-labels: |