diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index b569a99..11547ff 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -64,13 +64,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable branch; toolchain selected below
         with:
           # SHA-pinned, so the branch no longer selects the toolchain — name it.
           # libFuzzer's instrumentation (-Zsanitizer) is nightly-only.
           toolchain: nightly
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # The fuzz crate is its own workspace (detached so root `cargo test`
           # never builds it), so both trees need caching.
@@ -94,13 +94,13 @@ jobs:
       matrix:
         target: [nmea_parse, clock_aligner, mav_ingest]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable branch; toolchain selected below
         with:
           # SHA-pinned, so the branch no longer selects the toolchain — name it.
           # libFuzzer's instrumentation (-Zsanitizer) is nightly-only.
           toolchain: nightly
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           # The fuzz crate is its own workspace (detached so root `cargo test`
           # never builds it), so both trees need caching.