diff --git a/.github/workflows/build-capacitor.yml b/.github/workflows/build-capacitor.yml
index d1817926..39d8f25d 100644
--- a/.github/workflows/build-capacitor.yml
+++ b/.github/workflows/build-capacitor.yml
@@ -155,13 +155,6 @@ jobs:
           cache: 'pnpm'
           cache-dependency-path: pnpm-lock.yaml
 
-      - name: Setup Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: ${{ env.JAVA_VERSION }}
-          cache: 'gradle'
-
       - name: Setup Android SDK
         uses: android-actions/setup-android@v4
 
@@ -179,6 +172,18 @@ jobs:
           npx cap add android 2>/dev/null || true
           npx cap sync android
 
+      # setup-java's gradle cache keys off gradle-wrapper.properties / build.gradle
+      # files, which do not exist until Capacitor generates the native android/
+      # project above (it is gitignored, not committed) — so this step must run
+      # after "Add + Sync Capacitor Android", not before.
+      - name: Setup Java
+        uses: actions/setup-java@v6
+        with:
+          distribution: 'temurin'
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: 'gradle'
+          cache-dependency-path: frontend/platforms/mobile/android/**/*.gradle*
+
       - name: Build Android (Debug)
         if: inputs.build_type == 'debug'
         run: |
diff --git a/.github/workflows/build-react-native.yml b/.github/workflows/build-react-native.yml
index b4bf30ff..fbf6df0e 100644
--- a/.github/workflows/build-react-native.yml
+++ b/.github/workflows/build-react-native.yml
@@ -154,13 +154,6 @@ jobs:
           cache: 'pnpm'
           cache-dependency-path: pnpm-lock.yaml
 
-      - name: Setup Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: ${{ env.JAVA_VERSION }}
-          cache: 'gradle'
-
       - name: Setup Android SDK
         uses: android-actions/setup-android@v4
 
@@ -169,6 +162,18 @@ jobs:
           pnpm install --frozen-lockfile
           cd platforms/react-native && pnpm install --frozen-lockfile
 
+      # setup-java's gradle cache keys off gradle-wrapper.properties / build.gradle
+      # files, which do not exist until "Install dependencies" generates the
+      # native android/ project above (it is gitignored, not committed) — so
+      # this step must run after "Install dependencies", not before.
+      - name: Setup Java
+        uses: actions/setup-java@v6
+        with:
+          distribution: 'temurin'
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: 'gradle'
+          cache-dependency-path: frontend/platforms/react-native/android/**/*.gradle*
+
       - name: Build Android (Debug)
         if: inputs.build_type == 'debug'
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0cac09a0..234e0123 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -456,7 +456,7 @@ jobs:
       # files, which do not exist until Capacitor generates the native android/
       # project above (it is gitignored, not committed) — so this step must run
       # after "Sync Capacitor Android", not before.
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'temurin'
diff --git a/.github/workflows/deploy-mobile-android.yml b/.github/workflows/deploy-mobile-android.yml
index 2170daf5..fe8177b8 100644
--- a/.github/workflows/deploy-mobile-android.yml
+++ b/.github/workflows/deploy-mobile-android.yml
@@ -65,13 +65,6 @@ jobs:
           cache: 'pnpm'
           cache-dependency-path: pnpm-lock.yaml
 
-      - name: Setup Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: ${{ env.JAVA_VERSION }}
-          cache: 'gradle'
-
       - name: Setup Android SDK
         uses: android-actions/setup-android@v4
 
@@ -97,6 +90,18 @@ jobs:
         working-directory: frontend/platforms/mobile
         run: npx cap sync android
 
+      # setup-java's gradle cache keys off gradle-wrapper.properties / build.gradle
+      # files, which do not exist until "Sync Capacitor" generates/updates the
+      # native android/ project above (it is gitignored, not committed) — so
+      # this step must run after "Sync Capacitor", not before.
+      - name: Setup Java
+        uses: actions/setup-java@v6
+        with:
+          distribution: 'temurin'
+          java-version: ${{ env.JAVA_VERSION }}
+          cache: 'gradle'
+          cache-dependency-path: frontend/platforms/mobile/android/**/*.gradle*
+
       - name: Decode Android keystore
         working-directory: frontend/platforms/mobile/android
         env:
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index 75202945..6188667a 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -405,7 +405,7 @@ jobs:
         uses: pnpm/action-setup@v6
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: 'temurin'
           java-version: ${{ env.JAVA_VERSION }}
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index da8c3b03..31821dbb 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -279,7 +279,7 @@ jobs:
           cache-dependency-path: pnpm-lock.yaml
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: 'temurin'
           java-version: '17'
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 78d3ce40..b2c42f4b 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -331,7 +331,7 @@ jobs:
 
       - name: TruffleHog scan
         id: trufflehog
-        uses: trufflesecurity/trufflehog@bcfcf73aaf4759d4dadc2783177c245a02792318  # v3.97.0
+        uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b  # v3.97.1
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || '' }}
diff --git a/.github/workflows/validate-secrets.yml b/.github/workflows/validate-secrets.yml
index c7334496..4392feb1 100644
--- a/.github/workflows/validate-secrets.yml
+++ b/.github/workflows/validate-secrets.yml
@@ -311,7 +311,7 @@ jobs:
           fetch-depth: 0
 
       - name: TruffleHog OSS
-        uses: trufflesecurity/trufflehog@bcfcf73aaf4759d4dadc2783177c245a02792318  # v3.97.0
+        uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b  # v3.97.1
         with:
           path: ./
           base: ${{ github.event.repository.default_branch }}