diff --git a/.github/workflows/ai-testgen.yml b/.github/workflows/ai-testgen.yml
index 376f6aa..76f0458 100644
--- a/.github/workflows/ai-testgen.yml
+++ b/.github/workflows/ai-testgen.yml
@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK 25 (Temurin)
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: '25'
@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK 25 (Temurin)
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: '25'
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index d9c7dda..cdd49f8 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK 25 (Temurin)
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: '25'
diff --git a/.github/workflows/legacy-ci.yml b/.github/workflows/legacy-ci.yml
index f41200e..11c5745 100644
--- a/.github/workflows/legacy-ci.yml
+++ b/.github/workflows/legacy-ci.yml
@@ -30,7 +30,7 @@ jobs:
           ./scripts/check-schema-drift.sh
 
       - name: Set up JDK 8 (Temurin)
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: '8'
@@ -41,7 +41,7 @@ jobs:
 
       # ---- characterization gate (armed since stage-1-safety-net) ----
       - name: Set up JDK 25 (Temurin) for characterization
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: '25'
diff --git a/.github/workflows/modern-ci.yml b/.github/workflows/modern-ci.yml
index f7de57e..cad386f 100644
--- a/.github/workflows/modern-ci.yml
+++ b/.github/workflows/modern-ci.yml
@@ -28,7 +28,7 @@ jobs:
           echo "jdk=$v" >> "$GITHUB_OUTPUT"
 
       - name: Set up JDK ${{ steps.jdk.outputs.jdk }} (Temurin)
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: ${{ steps.jdk.outputs.jdk }}
@@ -39,7 +39,7 @@ jobs:
 
       # ---- equivalence gate: characterization vs the MODERN stand ----
       - name: Set up JDK 25 (Temurin) for characterization
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: '25'