diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 690bb84..4760020 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -22,7 +22,7 @@ jobs:
 
       # Toolchain from .mise.toml — the same pins `mise install` uses
       # locally, one source for both (same doctrine as the waas repo).
-      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4
+      - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4
 
       - run: npm ci
       - run: npm run typecheck
diff --git a/.github/workflows/version-cut.yml b/.github/workflows/version-cut.yml
index 8fbea5c..74fc12d 100644
--- a/.github/workflows/version-cut.yml
+++ b/.github/workflows/version-cut.yml
@@ -43,7 +43,7 @@ jobs:
           fi
           echo "version=$RAW" >> "$GITHUB_OUTPUT"
 
-      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4
+      - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4
       - run: npm ci
 
       - name: Sync CRD schemas at the released tag