diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b8d9043..8f26d044 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           persona: pedantic
           annotations: true
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 04619aac..37dd720d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -33,7 +33,7 @@ jobs:
 
       - name: Select mode
         id: select-mode
-        uses: ./select-mode
+        uses: $/select-mode
 
   version:
     name: Version
@@ -62,7 +62,7 @@ jobs:
 
       - name: Create or update release pull request
         id: changesets
-        uses: ./version
+        uses: $/version
         with:
           github-token: ${{ steps.bot-auth.outputs.token }}
           script: pnpm bump
@@ -92,7 +92,7 @@ jobs:
           permission-contents: write # to bypass branch and tag protection rules (release.ts)
 
       - name: Publish to marketplace
-        uses: ./publish
+        uses: $/publish
         with:
           github-token: ${{ steps.bot-auth.outputs.token }}
           script: pnpm release