diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index 5679d3a..97a4308 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -119,7 +119,7 @@ jobs:
             --source-revision "$SOURCE_REVISION" --output "$RUNNER_TEMP/crate-verified"
       - id: auth
         if: steps.verify.outputs.ready_for_upload == 'true'
-        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
       - id: upload
         if: steps.verify.outputs.ready_for_upload == 'true'
         env:
@@ -178,7 +178,7 @@ jobs:
           python3 tools/crate_release.py verify --release-id "$SOURCE_RELEASE_ID"
           --revision "$SOURCE_REVISION" --manifest-sha256 "$MANIFEST_SHA256"
       - id: auth
-        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
       - id: upload
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
diff --git a/tools/check-crate-release-policy.py b/tools/check-crate-release-policy.py
index 1d63db9..bdce1d5 100755
--- a/tools/check-crate-release-policy.py
+++ b/tools/check-crate-release-policy.py
@@ -18,7 +18,7 @@
 BOOTSTRAP_CHECK = ROOT / "tools" / "check-crate-publication.py"
 SOURCE_WORKFLOW = WORKFLOWS / "release.yml"
 EXPECTED_SOURCE_WORKFLOW_SHA256 = "13b592fd367f87ebc8c4926a514f110faadf4804206b8a2fd1e19c57b07d17c9"
-EXPECTED_PUBLICATION_WORKFLOW_SHA256 = "b21e9b715650b5f0b3f5b77eb563a4b78a0e5dbe9f07c09953fc64c6fe3f3c41"
+EXPECTED_PUBLICATION_WORKFLOW_SHA256 = "e1e02758989a4c8432dbcf8422e440041c7604980bb99fb04c003cfb01524a3b"
 EXPECTED_WORKFLOWS = {
     "dependency-review.yml", "pr-title.yml", "release.yml", "validate.yml",
     "publish-crate.yml", "crate-release-reconcile.yml",
diff --git a/tools/test_crate_release_policy.py b/tools/test_crate_release_policy.py
index 0fcac33..207a849 100755
--- a/tools/test_crate_release_policy.py
+++ b/tools/test_crate_release_policy.py
@@ -118,7 +118,7 @@ def test_rejects_publication_workflow_guard_drift(self) -> None:
             ("needs.verify.outputs.ready == 'true'", "always()"),
             ("persist-credentials: false", "persist-credentials: true"),
             ("ref: ${{ github.sha }}", "ref: main"),
-            ("c6f97d42243bad5fab37ca0427f495c86d5b1a18", "v1"),
+            ("3268eb413133e2960fa4ae0e963ca76380c54cd9", "v1"),
             ("contents: read", "contents: write"),
             ("id: upload", "id: other-upload"),
             ("!cancelled() && (steps.upload.outcome == 'success' || steps.upload.outcome == 'failure')", "success()"),