diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 1f42303..91621d8 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
 
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # pin@v6.0.1
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # pin@v6.1.0
         with:
           distribution: temurin
           java-version-file: '.java-version'
@@ -30,7 +30,7 @@ jobs:
 
       # ruby-version intentionally omitted — reads .ruby-version automatically.
       # bundler: 'Gemfile.lock' installs the exact version from BUNDLED WITH.
-      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # pin@v1.327.0
+      - uses: ruby/setup-ruby@824c0e29fdfc7d689c191c27acc969d2d04b7dd8 # pin@v1.331.0
         with:
           bundler: 'Gemfile.lock'
 
@@ -63,7 +63,7 @@ jobs:
           BUNDLE_GEMFILE: ${{ github.workspace }}/fastlane/Gemfile
           BUNDLE_PATH: ~/vendor/bundle
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pin@v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # pin@v7.0.2
         if: always()
         with:
           name: reports
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9f4bd0f..af1d71d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -191,14 +191,14 @@ jobs:
         with:
           ref: ${{ needs.validate-version.outputs.sha }}
 
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # pin@v6.0.1
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # pin@v6.1.0
         with:
           distribution: temurin
           java-version-file: '.java-version'
 
       - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # pin@v6.4.0
 
-      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # pin@v1.327.0
+      - uses: ruby/setup-ruby@824c0e29fdfc7d689c191c27acc969d2d04b7dd8 # pin@v1.331.0
         with:
           bundler: 'Gemfile.lock'
 
@@ -231,7 +231,7 @@ jobs:
           BUNDLE_GEMFILE: ${{ github.workspace }}/fastlane/Gemfile
           BUNDLE_PATH: ~/vendor/bundle
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pin@v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # pin@v7.0.2
         if: always()
         with:
           name: reports
@@ -379,7 +379,7 @@ jobs:
           fi
           echo "id=$id" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # pin@v6.0.1
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # pin@v6.1.0
         if: steps.preflight.outputs.action == 'publish'
         with:
           distribution: temurin
@@ -388,7 +388,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # pin@v6.4.0
         if: steps.preflight.outputs.action == 'publish'
 
-      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # pin@v1.327.0
+      - uses: ruby/setup-ruby@824c0e29fdfc7d689c191c27acc969d2d04b7dd8 # pin@v1.331.0
         if: steps.preflight.outputs.action == 'publish'
         with:
           bundler: 'Gemfile.lock'