diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 67d06e3..08f2e88 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
 
       - name: Set up JDK 25 LTS
         # actions/setup-java@v6.0.0 pinned to a commit SHA.
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
         with:
           distribution: temurin
           java-version: "25"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0e07570..7580e8b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Set up JDK
         # actions/setup-java@v6.0.0 — configures a settings.xml whose "github" server authenticates with the
         # workflow token granted by `packages: write` above.
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
         with:
           distribution: temurin
           java-version: "25"
diff --git a/.github/workflows/sandbox-live.yml b/.github/workflows/sandbox-live.yml
index 39184cd..22326c9 100644
--- a/.github/workflows/sandbox-live.yml
+++ b/.github/workflows/sandbox-live.yml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Set up JDK 25 LTS
         # actions/setup-java@v6.0.0 pinned to a commit SHA.
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
         with:
           distribution: temurin
           java-version: "25"