diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ab378c7..f92dd64 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -22,7 +22,7 @@ jobs:
 
       # Toolchain from .mise.toml — the same pins `mise install` uses
       # locally, one source for both (same doctrine as the waas repo).
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4
 
       - run: npm ci
       - run: npm run typecheck
diff --git a/.github/workflows/version-cut.yml b/.github/workflows/version-cut.yml
index 4d4ef0d..8b3be85 100644
--- a/.github/workflows/version-cut.yml
+++ b/.github/workflows/version-cut.yml
@@ -43,7 +43,7 @@ jobs:
           fi
           echo "version=$RAW" >> "$GITHUB_OUTPUT"
 
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4
       - run: npm ci
 
       - name: Sync CRD schemas at the released tag