diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 13a609af..78055b65 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,7 +60,7 @@ jobs:
 
       # Gradle itself runs on the baseline in every lane: its plugins, the formatter among them,
       # reach into javac internals a newer JDK is free to change. The lane's JDK runs the tests.
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
+      - uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6
         with:
           distribution: temurin
           java-version: |
@@ -138,7 +138,7 @@ jobs:
           ./tools/apt-get.sh update
           ./tools/apt-get.sh install --no-install-recommends -y tmux
 
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
+      - uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6
         with:
           distribution: temurin
           java-version: '25'
diff --git a/.github/workflows/clojure-compatibility.yml b/.github/workflows/clojure-compatibility.yml
index 732f6f4f..58f9c25f 100644
--- a/.github/workflows/clojure-compatibility.yml
+++ b/.github/workflows/clojure-compatibility.yml
@@ -25,7 +25,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
+      - uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6
         with:
           distribution: temurin
           # Gradle runs on 25 in every lane (last entry is JAVA_HOME); the lane's JDK runs the Clojure.
@@ -114,7 +114,7 @@ jobs:
           "$HOME/tmux-builds/$LANE/bin/tmux" -V
           echo "$HOME/tmux-builds/$LANE/bin" >> "$GITHUB_PATH"
 
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
+      - uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6
         with:
           distribution: temurin
           # Gradle runs on 25 in every lane (last entry is JAVA_HOME); the lane's JDK runs the Clojure.
@@ -203,7 +203,7 @@ jobs:
           "$HOME/tmux-builds/$LANE/bin/tmux" -V
           echo "$HOME/tmux-builds/$LANE/bin" >> "$GITHUB_PATH"
 
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
+      - uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6
         with:
           distribution: temurin
           # Gradle runs on 25 in every lane (last entry is JAVA_HOME); the lane's JDK runs the Clojure.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 487e326d..a6e82673 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -74,7 +74,7 @@ jobs:
           ./tools/apt-get.sh update
           ./tools/apt-get.sh install --no-install-recommends -y tmux
 
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
+      - uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6
         with:
           distribution: temurin
           java-version: '25'
diff --git a/.github/workflows/tmux-matrix.yml b/.github/workflows/tmux-matrix.yml
index c3c7ecaf..b16c9c9e 100644
--- a/.github/workflows/tmux-matrix.yml
+++ b/.github/workflows/tmux-matrix.yml
@@ -219,7 +219,7 @@ jobs:
           check "$SLUG" "$TMUX_REF" "$VERIFY"
           if [ -n "$CLIENT" ]; then check "$CLIENT" "$CLIENT" release; fi
 
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
+      - uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6
         with:
           distribution: temurin
           java-version: ${{ matrix.jdks }}