diff --git a/.github/workflows/bench-nightly.yml b/.github/workflows/bench-nightly.yml
index b6a7d90..8451619 100644
--- a/.github/workflows/bench-nightly.yml
+++ b/.github/workflows/bench-nightly.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
           toolchain: stable
-      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       # Restore the previous night's criterion baseline so tonight's run
       # compares against it and flags regressions. The restore-keys prefix
       # match finds the most recent previous entry even if the full key
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b06a527..b010cbf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
         with:
           toolchain: ${{ matrix.rust }}
           components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       - name: Install zstd (macos)
         if: matrix.os == 'macos-latest'
         run: brew install zstd
@@ -69,7 +69,7 @@ jobs:
         with:
           toolchain: "1.86"
           components: clippy
-      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       # Type-check AND lint on the MSRV toolchain. The `test` matrix already
       # runs clippy on 1.86, but this job gives faster feedback (no test
       # compilation) and makes the MSRV job self-contained — a regression in
@@ -142,7 +142,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
           toolchain: stable
-      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       # Loom requires `--cfg loom` so parking_lot 0.12 swaps in
       # `loom::sync::Mutex`. `--release` is required: loom's exhaustive
       # exploration is too slow on debug builds. Without this job the
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index a96abc0..0a38179 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
           toolchain: nightly
-      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       - name: Install cargo-fuzz
         run: cargo install cargo-fuzz --locked
       - name: Run ${{ matrix.target }} for 300s
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index daafe3a..a568d9c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -35,7 +35,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
           toolchain: stable
-      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       - name: cargo publish --dry-run --features encryption
         # No token needed for --dry-run. Catches missing files in the tarball,
         # manifest errors, and dependency resolution issues before a real tag.
@@ -51,7 +51,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
         with:
           toolchain: stable
-      - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
       - name: Verify tag matches Cargo.toml version
         run: |
           TAG="${GITHUB_REF#refs/tags/v}"