diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 3344d5f..bc276d9 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -26,11 +26,11 @@ jobs:
           distribution: temurin
           java-version-file: '.java-version'
 
-      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # pin@v6.4.0
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # pin@v6.4.1
 
       # ruby-version intentionally omitted — reads .ruby-version automatically.
       # bundler: 'Gemfile.lock' installs the exact version from BUNDLED WITH.
-      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # pin@v1.335.0
+      - uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94 # pin@v1.336.0
         with:
           bundler: 'Gemfile.lock'
 
@@ -81,9 +81,9 @@ jobs:
           distribution: temurin
           java-version-file: '.java-version'
 
-      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # pin@v6.4.0
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # pin@v6.4.1
 
-      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # pin@v1.335.0
+      - uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94 # pin@v1.336.0
         with:
           bundler: 'Gemfile.lock'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6b008fe..b7cf0b5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -302,9 +302,9 @@ jobs:
           distribution: temurin
           java-version-file: '.java-version'
 
-      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # pin@v6.4.0
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # pin@v6.4.1
 
-      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # pin@v1.335.0
+      - uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94 # pin@v1.336.0
         with:
           bundler: 'Gemfile.lock'
 
@@ -496,10 +496,10 @@ jobs:
           distribution: temurin
           java-version-file: '.java-version'
 
-      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # pin@v6.4.0
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # pin@v6.4.1
         if: steps.preflight.outputs.action == 'publish'
 
-      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # pin@v1.335.0
+      - uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94 # pin@v1.336.0
         if: steps.preflight.outputs.action == 'publish'
         with:
           bundler: 'Gemfile.lock'