diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d58fe59..1535ae6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,7 +122,7 @@ jobs:
             libfontconfig1-dev libxkbcommon-dev libxcb1-dev \
             libxcb-render0-dev libxcb-shape0-dev libxcb-xfixes0-dev libwayland-dev
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-      - uses: taiki-e/install-action@1beb33eee6d086258184383af9a538940be190ed # v2
+      - uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2
         with:
           tool: cargo-nextest
       # This is also the gate on the headless E2E smoke
@@ -141,7 +141,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: taiki-e/install-action@1beb33eee6d086258184383af9a538940be190ed # v2
+      - uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2
         with:
           tool: cargo-deny
       - run: cargo deny check
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 092758c..2b59c86 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -69,7 +69,7 @@ jobs:
             libfontconfig1-dev libxkbcommon-dev libxcb1-dev \
             libxcb-render0-dev libxcb-shape0-dev libxcb-xfixes0-dev libwayland-dev
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-      - uses: taiki-e/install-action@1beb33eee6d086258184383af9a538940be190ed # v2
+      - uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2
         with:
           tool: cargo-llvm-cov
       - name: Measure
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 74e7ec8..67e6c29 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -65,7 +65,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master
         with:
           toolchain: nightly
-      - uses: taiki-e/install-action@1beb33eee6d086258184383af9a538940be190ed # v2
+      - uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2
         with:
           tool: cargo-fuzz
       # The committed seeds in `fuzz/corpus/<target>/` are the starting point;
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 48c5078..f8dd902 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -438,7 +438,7 @@ jobs:
       # job on any error, so a red or advisory-drifted tag can never publish.
       # No rust-cache below this point: the signed build stays hermetic (a clean
       # build is the trade for reproducibility). ci.yml keeps its cache.
-      - uses: taiki-e/install-action@1beb33eee6d086258184383af9a538940be190ed # v2
+      - uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2
         with:
           tool: cargo-deny,cargo-nextest
       - name: Gate (cargo-deny)
@@ -631,7 +631,7 @@ jobs:
 
       - name: Install git-cliff
         if: env.PUBLISH == 'true'
-        uses: taiki-e/install-action@1beb33eee6d086258184383af9a538940be190ed # v2
+        uses: taiki-e/install-action@742a3317eac7bd62f91cd888b4eead5e784ba833 # v2
         with:
           tool: git-cliff
       # The published notes are the preamble followed by the generated changelog.