diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 42cf9fbef..6e244a23c 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -33,7 +33,7 @@ jobs:
           path: .casket-ssg
 
       - name: Setup GHCup
-        uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0
+        uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml
index ea87c43ad..5def8baf9 100644
--- a/.github/workflows/ci-pipeline.yml
+++ b/.github/workflows/ci-pipeline.yml
@@ -858,7 +858,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install GHC and Cabal
-        uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0
+        uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         with:
           enable-stack: false
 
diff --git a/.github/workflows/pages-archive.yml b/.github/workflows/pages-archive.yml
index e3166801d..404d50670 100644
--- a/.github/workflows/pages-archive.yml
+++ b/.github/workflows/pages-archive.yml
@@ -36,7 +36,7 @@ jobs:
           path: .casket-ssg
 
       - name: Setup GHCup
-        uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0
+        uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
diff --git a/.github/workflows/tailscale-connect-reusable.yml b/.github/workflows/tailscale-connect-reusable.yml
index b87f2ee65..fea7ba6fd 100644
--- a/.github/workflows/tailscale-connect-reusable.yml
+++ b/.github/workflows/tailscale-connect-reusable.yml
@@ -82,7 +82,7 @@ jobs:
       # Pinned per estate policy (SHA pins everywhere); refresh with `gh actions-lock`.
       - name: Connect to Tailscale
         if: steps.gate.outputs.ready == 'true'
-        uses: tailscale/github-action@780049a30b6ff5c378a9e7b389d15ece7a204888 # v4.1.3
+        uses: tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd # v4.2.0
         with:
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
           oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}