diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 5ad7fed..d516711 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -16,7 +16,7 @@ jobs:
 
       # The build targets a JDK 25 toolchain (spec section 5). Gradle itself runs on this JDK and
       # resolves the toolchain from it.
-      - uses: actions/setup-java@v6
+      - uses: actions/setup-java@v6.0.1
         with:
           distribution: temurin
           java-version: '25'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ee9f49b..fe76d6d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -122,7 +122,7 @@ jobs:
       # resolves it from the JDK it runs on; starting on an older one would make every release depend
       # on a toolchain download that the ordinary build never needs.
       - name: Set up JDK 25
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '25'