diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 1f42303..19ea0d6 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -30,7 +30,7 @@ jobs:
 
       # ruby-version intentionally omitted — reads .ruby-version automatically.
       # bundler: 'Gemfile.lock' installs the exact version from BUNDLED WITH.
-      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # pin@v1.327.0
+      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # pin@v1.329.0
         with:
           bundler: 'Gemfile.lock'
 
@@ -63,7 +63,7 @@ jobs:
           BUNDLE_GEMFILE: ${{ github.workspace }}/fastlane/Gemfile
           BUNDLE_PATH: ~/vendor/bundle
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pin@v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # pin@v7.0.2
         if: always()
         with:
           name: reports
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7de666e..48daf5e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -99,7 +99,7 @@ jobs:
 
       - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # pin@v6.4.0
 
-      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # pin@v1.327.0
+      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # pin@v1.329.0
         with:
           bundler: 'Gemfile.lock'
 
@@ -132,7 +132,7 @@ jobs:
           BUNDLE_GEMFILE: ${{ github.workspace }}/fastlane/Gemfile
           BUNDLE_PATH: ~/vendor/bundle
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pin@v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # pin@v7.0.2
         if: always()
         with:
           name: reports
@@ -190,7 +190,7 @@ jobs:
 
       - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # pin@v6.4.0
 
-      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # pin@v1.327.0
+      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # pin@v1.329.0
         with:
           bundler: 'Gemfile.lock'