diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 195e176..7d7289d 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -159,7 +159,7 @@ jobs:
       # Unlike cdcf-redis-translations, whose Composer deps are dev-only.
       - name: Setup PHP for cdcf-mcp runtime deps
         if: env.ENVIRONMENT == 'production'
-        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
         with:
           php-version: '8.3'
           tools: composer
diff --git a/.github/workflows/test-wordpress.yml b/.github/workflows/test-wordpress.yml
index 9580bb2..903e6a9 100644
--- a/.github/workflows/test-wordpress.yml
+++ b/.github/workflows/test-wordpress.yml
@@ -49,7 +49,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
         with:
           php-version: '8.3'
           # `:redis` removes the redis extension from the test runtime.