diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b914e0f..9d0a9d9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,10 +31,10 @@ jobs:
       # Verify gradle-wrapper.jar matches a known-good Gradle release checksum before it
       # is executed — guards against a tampered wrapper jar (a classic build-time backdoor).
       - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@5e2ebd065dc2488b7a6ad670704656cbbe1e8f60 # v6
+        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@5e2ebd065dc2488b7a6ad670704656cbbe1e8f60 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
 
       # The persistence integration suites self-skip when PKAUTH_SKIP_TESTCONTAINERS=1. The CI
       # gate must exercise them against real Postgres/DynamoDB Local, so fail loudly if that
diff --git a/.github/workflows/manual-release.yml b/.github/workflows/manual-release.yml
index f04f862..bab4bb4 100644
--- a/.github/workflows/manual-release.yml
+++ b/.github/workflows/manual-release.yml
@@ -62,7 +62,7 @@ jobs:
           distribution: 'temurin'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@5e2ebd065dc2488b7a6ad670704656cbbe1e8f60 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
 
       - name: Verify version matches tag
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 605e4f8..f00c982 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
           distribution: 'temurin'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@5e2ebd065dc2488b7a6ad670704656cbbe1e8f60 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
 
       - name: Verify version matches tag
         run: |