diff --git a/.github/workflows/check-windows.yml b/.github/workflows/check-windows.yml
index 85f243eb7..067344754 100644
--- a/.github/workflows/check-windows.yml
+++ b/.github/workflows/check-windows.yml
@@ -36,7 +36,7 @@ jobs:
           ref: ${{ inputs.ref }}
       - name: Setup soldr
         id: setup-soldr
-        uses: zackees/setup-soldr@67ed4018aca013f8388050ac9bc264244f9b742c
+        uses: zackees/setup-soldr@b782f606a2f3beadc35b9e3bf5b4565e005f52ed # v0.9.86
         with:
           cache-key-suffix: check-windows-check
           cache: true
diff --git a/.github/workflows/ci-full.yml b/.github/workflows/ci-full.yml
index 3516db06f..ac6872be6 100644
--- a/.github/workflows/ci-full.yml
+++ b/.github/workflows/ci-full.yml
@@ -128,7 +128,7 @@ jobs:
         with:
           ref: ${{ needs.verify.outputs.candidate_sha }}
           persist-credentials: false
-      - uses: zackees/setup-soldr@dfbe9627f6cb0226716b61625b99a58949162720
+      - uses: zackees/setup-soldr@b782f606a2f3beadc35b9e3bf5b4565e005f52ed # v0.9.86
         with:
           cache-preset: foundation
           prebuild-deps-flags: ""
diff --git a/.github/workflows/ci-minimal.yml b/.github/workflows/ci-minimal.yml
index c929b5423..70e2c56ae 100644
--- a/.github/workflows/ci-minimal.yml
+++ b/.github/workflows/ci-minimal.yml
@@ -82,7 +82,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
-      - uses: zackees/setup-soldr@dfbe9627f6cb0226716b61625b99a58949162720
+      - uses: zackees/setup-soldr@b782f606a2f3beadc35b9e3bf5b4565e005f52ed # v0.9.86
         with:
           cache-preset: foundation
           prebuild-deps-flags: ""
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index ac3e73a6c..8330913cc 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -70,7 +70,7 @@ jobs:
         with:
           ref: ${{ needs.verify.outputs.candidate_sha }}
           persist-credentials: false
-      - uses: zackees/setup-soldr@dfbe9627f6cb0226716b61625b99a58949162720
+      - uses: zackees/setup-soldr@b782f606a2f3beadc35b9e3bf5b4565e005f52ed # v0.9.86
         with:
           cache-preset: foundation
           prebuild-deps-flags: ""
diff --git a/.github/workflows/nightly-platforms.yml b/.github/workflows/nightly-platforms.yml
index ddec09b12..5965eb544 100644
--- a/.github/workflows/nightly-platforms.yml
+++ b/.github/workflows/nightly-platforms.yml
@@ -65,7 +65,7 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-      - uses: zackees/setup-soldr@dfbe9627f6cb0226716b61625b99a58949162720
+      - uses: zackees/setup-soldr@b782f606a2f3beadc35b9e3bf5b4565e005f52ed # v0.9.86
         with:
           cache-preset: foundation
           prebuild-deps-flags: ""
diff --git a/.github/workflows/template_build.yml b/.github/workflows/template_build.yml
index 8a65cf554..3812d477d 100644
--- a/.github/workflows/template_build.yml
+++ b/.github/workflows/template_build.yml
@@ -78,7 +78,7 @@ jobs:
         id: setup-soldr
         if: inputs.fbuild-artifact == ''
         # Canary exact setup-soldr main SHA before v0 promotion.
-        uses: zackees/setup-soldr@dfbe9627f6cb0226716b61625b99a58949162720
+        uses: zackees/setup-soldr@b782f606a2f3beadc35b9e3bf5b4565e005f52ed # v0.9.86
         with:
           # cache-preset: foundation expands to:
           #   build-cache: true, target-cache: false,
diff --git a/ci/render_workflows.py b/ci/render_workflows.py
index d6a86ef7e..62dd2f5e2 100644
--- a/ci/render_workflows.py
+++ b/ci/render_workflows.py
@@ -220,7 +220,7 @@ def render_fbuild_bin_job(needs: str, condition: str, ref: str) -> str:
         "        with:\n"
         f"          ref: {ref}\n"
         "          persist-credentials: false\n"
-        "      - uses: zackees/setup-soldr@dfbe9627f6cb0226716b61625b99a58949162720\n"
+        "      - uses: zackees/setup-soldr@b782f606a2f3beadc35b9e3bf5b4565e005f52ed # v0.9.86\n"
         "        with:\n"
         "          cache-preset: foundation\n"
         "          prebuild-deps-flags: \"\"\n"