diff --git a/.github/actions/nix-setup/action.yml b/.github/actions/nix-setup/action.yml
index bd9eefa..7910186 100644
--- a/.github/actions/nix-setup/action.yml
+++ b/.github/actions/nix-setup/action.yml
@@ -27,7 +27,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+    - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
 
     # Decide push vs pull-only once, off the event name and token presence, so
     # both Cachix steps share a single source of truth. `nix flake check` runs
@@ -59,7 +59,7 @@ runs:
 
     - name: Configure Cachix (pull-only)
       if: ${{ inputs.cachix-cache != '' && steps.cachix-mode.outputs.push != 'true' }}
-      uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+      uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866 # v17
       with:
         name: ${{ inputs.cachix-cache }}
         extraPullNames: nix-community
@@ -67,7 +67,7 @@ runs:
 
     - name: Configure Cachix (push-enabled)
       if: ${{ inputs.cachix-cache != '' && steps.cachix-mode.outputs.push == 'true' }}
-      uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+      uses: cachix/cachix-action@38b082610b782e7e93e209c35fd730d399dee866 # v17
       with:
         name: ${{ inputs.cachix-cache }}
         authToken: ${{ inputs.cachix-auth-token }}