diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 953c1da..e29196d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
           key: ${{ matrix.os }}-iroh4k-${{ hashFiles('iroh4k/src/rust/Cargo.lock') }}
           restore-keys: ${{ matrix.os }}-iroh4k-
 
-      - uses: gradle/actions/setup-gradle@v6
+      - uses: gradle/actions/setup-gradle@v6.2.0
 
       # Run the two test tasks in separate invocations. Sharing one invocation has been observed
       # to let a Rust rebuild swap the JNI shared library out from under a running test JVM,
@@ -115,7 +115,7 @@ jobs:
       - name: Install cargo-ndk
         run: command -v cargo-ndk || cargo install cargo-ndk --locked
 
-      - uses: gradle/actions/setup-gradle@v6
+      - uses: gradle/actions/setup-gradle@v6.2.0
 
       # The runner image exports ANDROID_NDK_HOME, which is where `rustJni` looks first; on a
       # machine without it the plugin falls back to ndk.dir/sdk.dir in local.properties.
@@ -238,7 +238,7 @@ jobs:
           key: ${{ matrix.os }}-${{ matrix.target }}-${{ hashFiles('iroh4k/src/rust/Cargo.lock') }}
           restore-keys: ${{ matrix.os }}-${{ matrix.target }}-
 
-      - uses: gradle/actions/setup-gradle@v6
+      - uses: gradle/actions/setup-gradle@v6.2.0
 
       - name: Assemble
         run: ./gradlew :iroh4k:assemble -Ptargets=${{ matrix.target }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 742c370..c8b2f81 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -123,7 +123,7 @@ jobs:
         shell: bash
         run: command -v cargo-ndk || cargo install cargo-ndk --locked
 
-      - uses: gradle/actions/setup-gradle@v6
+      - uses: gradle/actions/setup-gradle@v6.2.0
         if: matrix.android
 
       - name: Build Android JNI libraries
@@ -156,11 +156,11 @@ jobs:
       - name: Install Rust
         run: rustup show
 
-      - uses: gradle/actions/setup-gradle@v6
+      - uses: gradle/actions/setup-gradle@v6.2.0
 
       # The AAR needs an Android SDK to configure and package, and the publisher cannot move off
       # macOS to find one.
-      - uses: android-actions/setup-android@v3
+      - uses: android-actions/setup-android@v4
 
       - name: Resolve the version
         id: version
@@ -181,13 +181,13 @@ jobs:
         if: steps.version.outputs.release == 'true'
         run: scripts/check-release-version.sh "${{ steps.version.outputs.version }}"
 
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           pattern: rust-*
           merge-multiple: true
           path: rust-artifacts
 
-      - uses: actions/download-artifact@v7
+      - uses: actions/download-artifact@v8
         with:
           name: android-jnilibs
           path: iroh4k/src/androidMain/jniLibs