diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e78dbb8..d345cc4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           distribution: temurin
           java-version: "25"
-      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
       # Windows checkouts do not preserve the Unix executable bit reliably. Invoke
       # the pinned wrapper through Bash so CI depends on its content, not NTFS mode.
       - name: Test and verify every module
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3121502..9387b79 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
         with:
           distribution: temurin
           java-version: '25'
-      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
         if: matrix.language == 'java-kotlin'
       - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
         with:
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 4f4efd1..273502f 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           distribution: temurin
           java-version: "25"
-      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
       - run: bash ./gradlew :modules:app:jacocoTestReport :modules:document:jacocoTestReport :modules:compiler:jacocoTestReport :modules:syntax:jacocoTestReport :modules:psi:jacocoTestReport
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with: