diff --git a/.github/workflows/php-ext.yml b/.github/workflows/php-ext.yml
index 4300af92..b8001ae4 100644
--- a/.github/workflows/php-ext.yml
+++ b/.github/workflows/php-ext.yml
@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           # php-config + headers, needed by ext-php-rs's build.
diff --git a/.github/workflows/ruby-gems.yml b/.github/workflows/ruby-gems.yml
index 194decc4..6068293b 100644
--- a/.github/workflows/ruby-gems.yml
+++ b/.github/workflows/ruby-gems.yml
@@ -93,7 +93,7 @@ jobs:
         with:
           key: ${{ matrix.target }}
 
-      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           ruby-version: "3.3"
 
@@ -144,7 +144,7 @@ jobs:
       id-token: write # RubyGems Trusted Publishing (OIDC), no token needed
       contents: read
     steps:
-      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           ruby-version: "3.3"
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2