diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml
index ef05114..e503a35 100644
--- a/.github/actions/setup-nix/action.yml
+++ b/.github/actions/setup-nix/action.yml
@@ -50,7 +50,7 @@ runs:
       run: bash .github/ci/check-cache-config.sh
 
     - name: Connect to the private cache
-      uses: tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd # v4
+      uses: tailscale/github-action@99a8333667fff04fdd6cffb46dfd409f8329a7bf # v4
       with:
         oauth-client-id: ${{ inputs.tailscale-client-id }}
         audience: ${{ inputs.tailscale-audience }}
@@ -63,7 +63,7 @@ runs:
       run: bash .github/ci/nix-conf.sh --github-output
 
     - name: Install Nix
-      uses: DeterminateSystems/determinate-nix-action@d0c908e6cbe9f89f36ed8205a3ab6f092636916a # v3.23.1
+      uses: DeterminateSystems/determinate-nix-action@f296148a827001a9a82d3685b53210c06e5d3b67 # v3.24.0
       with:
         extra-conf: ${{ steps.nix-conf.outputs.conf }}
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3d1dead..616b99f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -31,7 +31,7 @@ jobs:
         # Best effort: forks have no OIDC token or variables, and a tailnet
         # outage must not block lint. Without it the checks build from source.
         continue-on-error: true
-        uses: tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd # v4
+        uses: tailscale/github-action@99a8333667fff04fdd6cffb46dfd409f8329a7bf # v4
         with:
           oauth-client-id: ${{ vars.NIX_CACHE_TS_CLIENT_ID }}
           audience: ${{ vars.NIX_CACHE_TS_AUDIENCE }}
@@ -49,7 +49,7 @@ jobs:
             bash .github/ci/nix-conf.sh --github-output --public-only
           fi
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@d0c908e6cbe9f89f36ed8205a3ab6f092636916a # v3.23.1
+        uses: DeterminateSystems/determinate-nix-action@f296148a827001a9a82d3685b53210c06e5d3b67 # v3.24.0
         with:
           extra-conf: ${{ steps.nix-conf.outputs.conf }}
       - name: Build every checks/*.nix check
diff --git a/.github/workflows/nightly-update.yml b/.github/workflows/nightly-update.yml
index 6d577b1..b74c065 100644
--- a/.github/workflows/nightly-update.yml
+++ b/.github/workflows/nightly-update.yml
@@ -145,7 +145,7 @@ jobs:
       # App-authenticated pushes and PR updates trigger CI without manual approval.
       - name: Create nightly GitHub App token
         id: nightly-app
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.NIGHTLY_APP_CLIENT_ID }}
           private-key: ${{ secrets.NIGHTLY_APP_PRIVATE_KEY }}