diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 91621d8..b22aa60 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -30,7 +30,7 @@ jobs:
 
       # ruby-version intentionally omitted — reads .ruby-version automatically.
       # bundler: 'Gemfile.lock' installs the exact version from BUNDLED WITH.
-      - uses: ruby/setup-ruby@824c0e29fdfc7d689c191c27acc969d2d04b7dd8 # pin@v1.331.0
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # pin@v1.335.0
         with:
           bundler: 'Gemfile.lock'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 617d48c..6b008fe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -304,7 +304,7 @@ jobs:
 
       - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # pin@v6.4.0
 
-      - uses: ruby/setup-ruby@824c0e29fdfc7d689c191c27acc969d2d04b7dd8 # pin@v1.331.0
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # pin@v1.335.0
         with:
           bundler: 'Gemfile.lock'
 
@@ -499,7 +499,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # pin@v6.4.0
         if: steps.preflight.outputs.action == 'publish'
 
-      - uses: ruby/setup-ruby@824c0e29fdfc7d689c191c27acc969d2d04b7dd8 # pin@v1.331.0
+      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # pin@v1.335.0
         if: steps.preflight.outputs.action == 'publish'
         with:
           bundler: 'Gemfile.lock'