diff --git a/.github/actions/gradle-setup/action.yml b/.github/actions/gradle-setup/action.yml
index 35c5f9517b..c685e880c5 100644
--- a/.github/actions/gradle-setup/action.yml
+++ b/.github/actions/gradle-setup/action.yml
@@ -49,7 +49,7 @@ runs:
       uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
 
     - name: Set up JDK 25
-      uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
       with:
         java-version: '25'
         distribution: ${{ inputs.jdk_distribution }}
@@ -67,7 +67,7 @@ runs:
       if: inputs.install_jetbrains_jdk == 'true' && steps.cache-jbr.outputs.cache-hit != 'true'
       id: setup-jbr
       continue-on-error: true
-      uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
       with:
         java-version: '25'
         distribution: 'jetbrains'
diff --git a/.github/workflows/verify-flatpak.yml b/.github/workflows/verify-flatpak.yml
index 0fd39e3dc9..55567c6c59 100644
--- a/.github/workflows/verify-flatpak.yml
+++ b/.github/workflows/verify-flatpak.yml
@@ -67,7 +67,7 @@ jobs:
           fi
           echo "OK: $manifest vendors $wrapper_dist, matching $props"
 
-      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
         with:
           distribution: temurin
           java-version: 25
@@ -76,7 +76,7 @@ jobs:
       # JBR resolves its version list via the GitHub API — unauthenticated requests
       # rate-limit on the shared runner IPs, so the token is required, not optional.
       # Non-fatal, matching .github/actions/gradle-setup: Gradle falls back to Foojay.
-      - uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
         id: setup-jbr
         continue-on-error: true
         with: