diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fcb8dba..eddc659 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
 
       - name: Set up JDK 25 LTS
         # actions/setup-java@v6.0.1 pinned to a commit SHA.
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
         with:
           distribution: temurin
           java-version: "25"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1a05ae0..f6e7106 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
       - name: Set up JDK
         # actions/setup-java@v6.0.1 — configures a settings.xml whose "github" server authenticates with the
         # workflow token granted by `packages: write` above.
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
         with:
           distribution: temurin
           java-version: "25"
@@ -71,7 +71,7 @@ jobs:
 
       - name: Set up JDK
         # actions/setup-java@v6.0.1
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
         with:
           distribution: temurin
           java-version: "25"